url encoding working. just need 403 now