CI_Security: URL-decode until possible