Allow remoting of unsafe strings, and protect encoding of RelayState URLs.