Actually, it was easy, even if not so clean: I just did some URL rewriting in the REST endpoint to convert all + characters in input REST URLs to %20.