correctly sanitize UTF8 URLs