<a download href="chrome://settings/"> and similar weird download links result in bad URLs being added to the download page, and those added URLs are clickable there.  We should do something better here.  This is because we don't do the normal set of security checks before the download makes it to the downloads system.

Assigning this to asanka, who's working on a doc on what we should be doing here.