always use https for source URLs
decode query parameters as UTF-8.

needed for msg parameters with people's names that might contain unicode chars.
goes with this webutil change: e7fe25c65efbe5eb18371c85d57fcbb47380e281