Any url escaping required here? What if the `user => "something&funky"` ?