fix issue #1 - handle colon in decode()

Fixes the problem described in issue #1. I don't like that this doesn't handle a username with a colon in it, but I can't think of a good way to handle it - from my testing common HTTP clients happily base64 colon into the username and password strings without any kind of HTTP encoding, I don't think there's anything to do but split on the first occurrence of colon :boom: