`env.url_to`: Return null on bad apiPath/params.
Return 'Bad Request' on plain HTTP/RPC when encryption is required.