url encoding for usernames and passwords