formally escape % so everything is URL-encoded