The url parameter is being decoded an extra time, meaning that normalization of bad urls is not possible in a straightforward way.
The offending second decode is lib/image-magick.js line 202, which causes it to fail on urls like
http://localhost:3000/resize/magic?size=100x100&url=http%3A%2F%2Fthegenericman.com%2Fassets%2Fimg%2Fproduct_images%2Ftgm%2520large%2FGNRCMAN_122211-739.jpg
due to cURL's lack of normalization on its end (see #9).
Using params.url directly instead of decoding it (it's already been decoded at this point) resolves the issue.