params has already been url-decoded. if oauth_signature is url-decoded
again it will produce incorrect results when a + occurs in the
signature string