Fix lack of URL normalization

This release fixes CVE-2020-24660. Before this release, when access rules are used inside a protected host, some URL encodings may bypass filtering system (see also security advisory).