Currently, if it can't find a match for the URL it uses the whole thing (lightly munged) as a value for the route label.

This is a bad idea, if you have malicious folks on other the end of the wire.