add url-decode options to CLI
cleanup -- move declarations of urldecode functions next to definitions
Fix off-by-1 errors that allowed bypass in EUC-JP character sets for javascript URLs