CSRF token in url-encoded body is url-decoded twice

1. by body-parser, and
2. by authHandler

Introduced in 36b97ff955bd81ff88e8bacff38137fc46aca960

-----

```sh
$ curl http://localhost:8383/v1/projects/1/forms/1/submissions.csv.zip -H 'Cookie: session=' -H 'x-forwarded-proto: https' -H 'content-type: application/x-www-form-urlencoded' --data '__csrf=%25ea'
{"message":"Internal Server Error"}
```

Reproduce the failure with the provided curl request against the submissions.csv.zip endpoint, then trace how the url-encoded body moves through body-parser and authHandler. Confirm where the CSRF token is decoded twice; done means the same request no longer returns Internal Server Error because of the double decoding.

Written by the indexing model from the issue text.