check no-change also in normal xss
better url encoding... (including / now)