Bring back the URL escaping code, but use a better character whitelist.
release-2.x.y
2014-01-13, Mark Doliner