Double protect URL arguments in gear (users can't break gear deployment)

[merge]