browsers will accept strangely formed URLs and this could be used to bypass security checks