fixed url parsing; postpone fragment parsing after authority parsing; added test cases to test/urltest.lua

fixed reference patterns in check_protect() to upper case hex letters

src/url.lua

@@ -139,16 +139,16 @@ function _M.parse(url, default)
         parsed.authority = n
         return ""
     end)
-    -- get query string
-    url = string.gsub(url, "%?(.*)", function(q)
-        parsed.query = q
-        return ""
-    end)
     -- get fragment
     url = string.gsub(url, "#(.*)$", function(f)
         parsed.fragment = f
         return ""
     end)
+    -- get query string
+    url = string.gsub(url, "%?(.*)", function(q)
+        parsed.query = q
+        return ""
+    end)
     -- get params
     url = string.gsub(url, "%;(.*)", function(p)
         parsed.params = p