caldav: don't crash on bogus HREF to multiget

TODO: actually spit out 404s for all the bogus URLs
extradomain: handle admin having it too