This isn't true any more. We strip all non-alphabetic or numeric chars, except unicode \u00C0 to \uFFFF, `.`,  `/`, `-`, `:`, `_`, `%`. We also strip URI encoded `<` and `>`