Explicitly disallow NUL characters in URL parameters

Explicitly disallow NUL characters in URL parameters

This would already not work at a lower layer, but would typically
generate an internal server error exception instead of just an error
message.

Instead, put an explicit check in the middleware that's already
validating the query parameters and reject them with a 400 error.