Make URL password substitution do the correct escaping. Ideally this would be done all the way in platform/URL rather than the DOMURL level.
That's how it's implemented. html/URLDecomposition mostly forwards to wtf/URL, except for some state checks.