Ouch. Back to the drawing board. This is quite bad. It seems the standard among web apps is to parse the path *before* decoding, hence a%2Fb is rarely the same as a/b. The former usually returns a 404.

I'll add a getRawPath for this.