safeguard uri-decodes