liberalize regular expressions

These only care about being a single url part (no /), there’s no reason to be more restrictive than that.

closes #311