fix url encoding (%xx accepted every alphanumeric character instead of just hex digits)