bug fix: params are now unescaped using Rack::Utils