web: unquote args for some godawful reason

on my production server something isn't un-urlencoding the args we get
from the AJAX calls to on/off, so let's just do it manually.