don't actually quote the redirect url, it can get double encoded