ampersands and semicolons aren't reencoded

hi,

if the request contains ampersands and semicolons, they're not reencoded correctly. attached failing test shows the bug. I think the solution is to use CGI.escape/unescape instead of URI.encode/decode, but I'm not sure if that's correct for all headers -- HTTP_REFERER, for example, might need URI.encode/decode.

in our app with the middleware present, this bug exhibited itself by truncating GET parameters following an escaped "&" or ";" character.

thanks!