url must be unencoded