& is disallowed in request urls