Development confirms we always have included a "Content-type: application/x-www-form-urlencoded" HTTP header when we POST to Integration and Keygen URLs. The letter casing there was slightly different vs. typical practice ('Content-type' vs. 'Content-Type'), which shouldn't matter since the RFC specifies that field names are case-insensitive. Even so, we went ahead and updated that anyway to match the more typical casing, just in case your host's security filter was incorrectly rejecting the submissions for that reason.