Fixed: URL normalization for SecHashEngine