urldecode query params before generating access tokens and auth signatures

Since the docs are pretty clear about the URL's having to be un-encoded when used for generating the access tokens and auth info it might be a good idea to enforce this on the server.