Unescape a URL-encoded string for the header value.  Also does
an early escape from the method if the cookie isn't there.