Probably I misunderstand the first message "Prevent illegal characters from 
ever being typed in any URL forms". The way to prevent the illegal characters 
ever being enter was to detect and erase them. A popup dialog may be a 
distraction. Displaying information at the bottom of the window is better.

So do we want to detect illegal characters and erase them with a message being 
displayed at the bottom of the window while the user is typing? Or just do a 
check after the user types enter or clicks apply button? I think the latter 
has been done by the current SWOOP.