Decodes '%'-escaped octets before extracting the verifier