url unquote the path before checking if it refers to a CGI script (closes #21766)
merge 3.2 (#21766)