DO NOT MERGE YET: Fix url decode

Scanning through the code coverage I noticed an unexcercised path in the handling of ns_uri_decode errors that made me notice that the current implementation might be to lax. Do you think ns_uri_decode should fail on invalid escapes (as shown in the tests added in b45ba51) ?