URL-escaped key with JS redirect: remove redirect or decode externally