fix #401 profile url collisions

Added the underscore. Keeping -'s and _'s as is, replacing \s's with +'s. Won't result in collisions if inputs are limited to the whitelisted character ranges.