stop urls being encoded, not sure about other security implications here...