Allow unescaped @ in urlencoded parameters

At least Internet Explorer does not url encode the `@` symbol, such as
when in an email address, in it's form uploading from HTML. Since the `@`
symbol doesn't have any special meaning in the querystring of a URL, not
encoding it shouldn't present any problems. Thus, we should add `@` to the
list of allowed characters in form urlencoded data.