For externally-visible params (things in redirect URLs, POST parameters, JSON response bodies), we should probably stick with the spec. For internal stuff, go wild.