As previously mentioned by @boffbowsh [here](https://github.com/Shopify/active_merchant/pull/1027#discussion-diff-9616149) and after checking the CG API documentation (page 4), each `val` from the body would be URL encoded.

It would be less bug-prone in future and make logical sense to perform a `CGI.unescape(val)` here so you know everything has safely been unescaped, rather than piecemeal unescaping later on.