replace URL-sensitive characters in secret