URL decode injections

Santize URLs generated from path parameters.

The processing chain does URL decodes so a path of `/food-alerts/codes/alerts/def/status%22` will be received as `/food-alerts/codes/alerts/def/status"` which should not be used as a legal URI to query againts.