url safe encoding, using only login form