Better URL sanitizing

This also switches to hitting the API servlet directly instead of Nginx, because Nginx will unescape the non-alphanumerics before proxying the request, which will break any API request with a forward slash in a parameter value

[Fixes #47856683]