           response.end('405 Method Not Allowed')
       else if TAGS_REGEX.test(urlParts.pathname)
         r = TAGS_REGEX.exec(urlParts.pathname)
-        deviceId = r[1]
-        tag = r[2]
+        deviceId = querystring.unescape(r[1])
+        tag = querystring.unescape(r[2])
         if request.method == 'POST'
           db.devicesCollection.update({'_id' : deviceId}, {'$addToSet' : {'_tags' : tag}}, {safe: true}, (err) ->
             if err

          response.writeHead 405, {'Allow': 'GET'}
          response.end('405 Method Not Allowed')
      else if FILES_REGEX.test(urlParts.pathname)
        filename = FILES_REGEX.exec(urlParts.pathname)[1]
        if request.method == 'PUT'
          metadata = {
            SoftwareVersion : request.headers.softwareversion,

          response.end('405 Method Not Allowed')
      else if TASKS_REGEX.test(urlParts.pathname)
        if request.method == 'POST'
          deviceId = querystring.unescape(TASKS_REGEX.exec(urlParts.pathname)[1])
          if body
            # queue given task
            task = sanitizeTask(deviceId, JSON.parse(body))

            db.tasksCollection.save(task, (err) ->
              if err
