url field sanitization applies universally, with the ':' and '/' as safe characters