harden against unescaped stuff in urls