Unescaped ampersand in URL