Backport from trunk r9937

Fixed matching identity rules when using percent encoded URIs