I think it's ok to allow `:`, because the namespace is explicitly just up to the first `:`. As for the other characters... Do we want to ban them? Or just plan on url-encoding the whole thing?