WIP: url-encode keys

Not actually necessary because they don't even include any forbidden
characters, but it's part of the specc