Transform url characters when decoding payload

Facebook sometimes passes payload containing "_" in them (when encoding "?" in the URL).

This PR ensures such corner cases are handled.

The test is a little different since the payload encoded using fb_signed_request:generate/2 for the same payload does not contain "_" in them (FB possibly uses a different encoding format).