Adding: URLs are often seen as nothing special though and end up in logs galore or visible to various intermediary software to forward/proxy/cache. I think they should/must always be kept free of any special information.