decodes an urlencoded string (%20 to ' ' e.g.)