They are url encoded, but some app servers (like JBoss) don't allow urls with encoded slashes by default, because of security issues. We should encode the / some other way probably before url encoding.