clarify URI template handling

"Arguments that are substituted for URI template parameters MUST be percent escaped for non-URL characters."

1) "percent escaping" (RFC 3986) is defined in terms of octets, so we need to specify that characters first need to be encoded in UTF-8

2) non-URL characters in underspecified as well; please refer to a grammar production in RFC 3986; for instance, what about "&" (which certainly is a "URL" character)