assertEscaping(e, "%29", ')');
    assertEscaping(e, "%7E", '~');
    assertEscaping(e, "%27", '\'');

    // Plus for spaces
    assertEscaping(e, "+", ' ');
    assertEscaping(e, "%2B", '+');

    assertEquals("safe+with+spaces", e.escape("safe with spaces"));
    assertEquals("foo%40bar.com", e.escape("******@****.***"));
  }

  public void testUrlPathSegmentEscaper() {

    assertEquals("string with spaces", spaceEscaper.escape("string with spaces"));
  }

  /** Tests that if we add extra 'safe' characters they remain unescaped */
  public void testCustomEscaper() {
    UnicodeEscaper e = new PercentEscaper("+*/-", false);
    for (char c = 0; c < 128; c++) {
      if ((c >= '0' && c <= '9')
          || (c >= 'a' && c <= 'z')
          || (c >= 'A' && c <= 'Z')

        pathMappingList.add(pathMapping);

        pathMappingHelper.cachedPathMappingList = pathMappingList;

        String text = "\"file:///home/user with spaces/\"";
        assertEquals("\"http://localhost/user with spaces/\"", pathMappingHelper.replaceUrls(text));
    }

    public void test_replaceUrl_withSpecialCharacters() {
        final String sessionId = "test";

    assertEquals("string with spaces", spaceEscaper.escape("string with spaces"));
  }

  /** Tests that if we add extra 'safe' characters they remain unescaped */
  public void testCustomEscaper() {
    UnicodeEscaper e = new PercentEscaper("+*/-", false);
    for (char c = 0; c < 128; c++) {
      if ((c >= '0' && c <= '9')
          || (c >= 'a' && c <= 'z')
          || (c >= 'A' && c <= 'Z')

The spec also states that the `username` and `password` must be sent as form data (so, no JSON here).

### `scope` { #scope }

The spec also says that the client can send another form field "`scope`".

The form field name is `scope` (in singular), but it is actually a long string with "scopes" separated by spaces.

Each "scope" is just a string (without spaces).

    assertEscaping(e, "%29", ')');
    assertEscaping(e, "%7E", '~');
    assertEscaping(e, "%27", '\'');

    // Plus for spaces
    assertEscaping(e, "+", ' ');
    assertEscaping(e, "%2B", '+');

    assertEquals("safe+with+spaces", e.escape("safe with spaces"));
    assertEquals("foo%40bar.com", e.escape("******@****.***"));
  }

  public void testUrlPathSegmentEscaper() {

        assertEquals("RAdministrators", permissionHelper.encode("{role}Administrators"));
        assertEquals("D1user with spaces", permissionHelper.encode("(deny){user}user with spaces"));
        assertEquals("DR_role_with_underscores", permissionHelper.encode("(deny){role}_role_with_underscores"));
        assertEquals("D2group123", permissionHelper.encode("(deny){group}group123"));

        System.setProperty("empty", "");
        String value = "${empty}";
        assertEquals("", ResourceUtil.resolve(value));

        // Test property with just spaces
        System.setProperty("spaces", "   ");
        value = "${spaces}";
        assertEquals("   ", ResourceUtil.resolve(value));

        // Test long property name
        System.setProperty("very.long.property.name.with.many.dots", "long");

 * within the nested {@link TextNormalizeContext} class.
 *
 * <p>The text normalization process includes:
 * <ul>
 *   <li>Treating ISO control characters and specified space characters as spaces.</li>
 *   <li>Appending alphanumeric characters (0-9, A-Z, a-z) to the buffer.</li>
 *   <li>Appending symbol characters (!-/, :-@, [-`, {-~) to the buffer.</li>

The content of each of these strings can have any format, but should not contain spaces.

These scopes represent "permissions".

In OpenAPI (e.g. the API docs), you can define "security schemes".

When one of these security schemes uses OAuth2, you can also declare and use scopes.

Each "scope" is just a string (without spaces).