liberalize regular expressions

these only care about being a single url part (no /),
there’s no reason to be more restrictive than that.

closes #311