I read the spec. It clearly says “must not redirect.” Mystery solved.