url_unescape: fix ordering of "+" => " " of swap