url-handling

Go's net/url.JoinPath treats every input as a path segment, so passing "/auth/logout?all_devices=true" produces "/api/v1/auth/logout%3Fall_devices=true" with the question mark URL-encoded into the pat...