decode URLs before processing them (fixes #4507)