validation for url characters in claim type/value