This is kinda gross, but it appears that express does not play well with parentheses in URLs.  Since we currently build slugs from the badge name, and the name can include parentheses, such URLs exist in our system.  Because parentheses are valid in a URL, normal middleware stuff doesn't encode them, hence this hack.