Specifically, those that contain a spurious % in the request line.

Test this, explicitly asserting both the returned status code and that we don't print a traceback.

Fixes #1708.