Disallow control codes in urldecode