Route: percent-encoded bytes are decoded before URL is matched

Isn't it now possible to abuse this like `http://example.com/foo/%25basePath%25/bar/`?