Fix self XSS in request url.

A user who has copy/pasted data from another or has been tricked into pasting into the accessToken box could XSS him/herself.

It's a small vuln but simple to fix.

![Imgur](http://i.imgur.com/qVXjg6J.png)