After a rejected login the site redirects back to /login carrying the API's
error message in the query string. That message is Persian, and HTTP header
values must be ASCII, so Kestrel threw InvalidOperationException and the user
got an error page instead of the login form with the reason for the failure.
Encode both the path and the message.
Not noticed before because IIS Express tolerates the non-ASCII Location header;
it surfaces as soon as the site is run on Kestrel.
e7fbc6559d