decode user and password as they'll be re-encoded later on; fixes issues with @ in usernames, for example.