URI::Decode or not to URI::Decode when filtering

I am writing a basic URL filter to allow a handful of URLS.

Is it more secure to filter on the raw URL or the URI:Decode'd URL?

The biggest concern is security. I don't people to be able to use %/hex codes to bypass the URL filter

Here are the two options I see

when HTTP_REQUEST {
switch -glob [string tolower [HTTP::uri]] {
/webserver/login* { 
pool web.acmehosting.com 
}
/webserver/logout* { 
pool web.acmehosting.com 
}
default {
drop
}
}
}

or should I be using

when HTTP_REQUEST {
switch -glob [URI::decode [string tolower [HTTP::uri]]] {
/webserver/login* { 
pool web.acmehosting.com 
}
/webserver/logout* { 
pool web.acmehosting.com 
}
default {
drop
}
}
}