...

• The only change of behaviour will be on JMX metrics containing a client-id. The client-id will now be URL-encoded, only affecting client-ids containing special characters.
  

Rejected Alternatives

Instead of properly URL-encoding client-ids, we first looked into simply using ObjectName.quote() when using the client-id in metrics. This would change all existing metrics as we would be quoted. Also it feels cleaner to use the same sanitizing logic for both client-ids and user principals.