encode password in URL