allow & for urls