unencode an ampersand in a URL