Get the url path before using unquote, circumventing problems with encoded special characters like '?'.
Get rid of the paths leading '/' so that the following if statements still work (this also gets rid of .lstrip(config['VIDEOPREFIX'])).
Change the auth check for thumbnails, from checking the ending('.jpg') to checking the beginning ('thumbnails/').