This was due to a server side bug when unicode usernames have been enabled. We were double encoding the unicode username in the URL resulting in a invalid URL.
%{key}