bugfix: allow GET/POST values starting with - (dash)