If `decodeURIComponent` error happen, just return the original value.

We need to catch decodeURIComponent() error, otherise it easy to make attack
request by `GET http://hostname/foo-category/100%`.