Use unescape for sanity parsing of select2 results

decodeURIComponent not valid any more, since the d.text versions of
things aren't URI components, and may include random percent signs that
are totally valid in this context.