Fix the mismatch between OAuth's  RFC3986's and Javascript's beliefs in what is right and wrong

A similar fix was applied to POST operations