One man’s URL encoding is another man’s bug