url unquote the path before checking if it refers to a CGI script (closes #21766)