Any character can be allowed, although that is a mess if you need to handle it in a regular filesystem.
Each element of the URL needs to be urlencoded so that the slashes internal to the directory name are encoded, but the real seperators between url elements are not.
