bad unicode in URLs shouldn't cause 500

`decode_argument` doesn't catch unicode errors, so requesting `%FF` or other invalid encoding to a handler capturing `(.*)` will result in 500 errors.

This PR raises 400 instead.