403 Forbidden on PHP page called with url encoded in a $_GET parameter

Given hello.php: ``` <?php echo "Hello"; ?> ``` rendering the page works fine and returns Hello, however ``` http://example.com/hello.php?test=http%3a//whatever.com ``` returns a 403 Forbidden. But oddly enough, making the first letter of http uppercase works fine: ``` http://example.com/hello.php?test=Http%3a//whatever.com ``` FYI, percent encoding the slashes also 403s: ``` http://example.com/hello.php?test=http%3a%2f%2fwhatever.com ``` I'm beginning to suspect this may be an issue with Passenger (which I use to serve RoR)