escape urls and user/pass