When a user requests the blackhole callback as an action we should blackhole that request. The blackhole callback should not be URL accessible. Fixes #3496