Username and password must be URI-escaped

Not just "%", "@", and ":" must be escaped, all delimiters from RFC 3986 must be percent-encoded. Therefore, since "/" must be escaped in username and password, we can split the URI at the first "/" instead of the last. Delimiters are also prohibited in the auth database name, but allow ".".