but don't url_escape EVERYTHING