@Test
public void rejectsUrlSafeBase64() {

  assertThat(validator.isValid("a+/", null)).isTrue();
  // KeywhizFS assumes normal base64, not the url safe variant.
  assertThat(validator.isValid("b-_", null)).isFalse();
}