Without this relative URLs passed (like /message/index.php)
were being redirected to HOST/message/index.php rather than
$CFG->wwwroot/message/index.php.
If you pass a URL that is not a valid URL (for example
';') it is cleaned to an empty string which redirects to
$CFG->wwwroot/message/output/popup/ which is not a valid
page.