RFC 3987 defines a number of unwise characters, including `<>{}^\%"|` (and the backtick). These characters should be disallowed from URL paths.