SECURITY: Work around PHP bug in parse_url