Maybe the location bar should accept the space but strip it? That would work for input if not reading the URL. Maybe only allowing single consecutive spaces to avoid the address spoofing example. I could go for that.

I would love & natively though. For my wedding (bride&groom.com for example) I looked into faking it with punycode but nothing was close enough, and anything other than an ampersand would have been too hard to input.