CRM-16832. Do not redirect offsite when fed invalid keys.