Protect from incidental mutation of URL

Session.prepare_url is mutating and that makes Session.temp(domain, token) mutate domain without communicating that to the user in any way.