URLs should be unescaped as we find them

Rather than letting url.Parse() barf when it spots hexadecimal in a
URL string we should escape it correctly.