I know this isn't entirely related, but we should be CGI escaping `request.key` here.