diff --git a/java/google/registry/tools/AppEngineConnection.java b/java/google/registry/tools/AppEngineConnection.java
index a98e847cb..2a71272fe 100644
--- a/java/google/registry/tools/AppEngineConnection.java
+++ b/java/google/registry/tools/AppEngineConnection.java
@@ -102,8 +102,7 @@ class AppEngineConnection {
   private String internalSend(
       String endpoint, Map<String, ?> params, MediaType contentType, @Nullable byte[] payload)
       throws IOException {
-    GenericUrl url = new GenericUrl(getServer());
-    url.setRawPath(endpoint);
+    GenericUrl url = new GenericUrl(String.format("%s%s", getServer(), endpoint));
     url.putAll(params);
     HttpRequest request =
         (payload != null)
diff --git a/javatests/google/registry/tools/AppEngineConnectionTest.java b/javatests/google/registry/tools/AppEngineConnectionTest.java
new file mode 100644
index 000000000..f8228223f
--- /dev/null
+++ b/javatests/google/registry/tools/AppEngineConnectionTest.java
@@ -0,0 +1,143 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.tools;
+
+import static com.google.common.truth.Truth.assertThat;
+import static google.registry.security.JsonHttp.JSON_SAFETY_PREFIX;
+import static java.nio.charset.StandardCharsets.UTF_8;
+import static org.mockito.Mockito.when;
+
+import com.google.api.client.http.HttpTransport;
+import com.google.api.client.http.LowLevelHttpRequest;
+import com.google.api.client.http.LowLevelHttpResponse;
+import com.google.common.collect.ImmutableMap;
+import com.google.common.net.MediaType;
+import google.registry.testing.MockitoJUnitRule;
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.util.HashMap;
+import org.junit.Before;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+import org.mockito.Mock;
+
+@RunWith(JUnit4.class)
+public final class AppEngineConnectionTest {
+
+  @Rule public final MockitoJUnitRule mocks = MockitoJUnitRule.create();
+
+  AppEngineConnection connection;
+  TestHttpTransport httpTransport;
+  TestLowLevelHttpRequest lowLevelHttpRequest;
+  @Mock LowLevelHttpResponse lowLevelHttpResponse;
+
+  private final class TestHttpTransport extends HttpTransport {
+    String method = null;
+    String url = null;
+
+    @Override
+    protected LowLevelHttpRequest buildRequest(String method, String url) {
+      // Make sure we only visit once
+      assertThat(this.method).isNull();
+      this.method = method;
+      this.url = url;
+      return lowLevelHttpRequest;
+    }
+  }
+
+  private final class TestLowLevelHttpRequest extends LowLevelHttpRequest {
+    final HashMap<String, String> headers = new HashMap<>();
+
+    @Override
+    public void addHeader(String name, String value) {
+      headers.put(name, value);
+    }
+
+    @Override
+    public LowLevelHttpResponse execute() {
+      return lowLevelHttpResponse;
+    }
+
+    String getContentString() throws Exception {
+      ByteArrayOutputStream output = new ByteArrayOutputStream();
+      getStreamingContent().writeTo(output);
+      output.close();
+      return new String(output.toByteArray(), UTF_8);
+    }
+  }
+
+  @Before
+  public void setUp() throws Exception {
+    lowLevelHttpRequest = new TestLowLevelHttpRequest();
+    when(lowLevelHttpResponse.getContent())
+        .thenReturn(new ByteArrayInputStream("MyContent".getBytes(UTF_8)));
+    when(lowLevelHttpResponse.getStatusCode()).thenReturn(200);
+
+    connection = new AppEngineConnection();
+    httpTransport = new TestHttpTransport();
+    connection.requestFactory = httpTransport.createRequestFactory();
+  }
+
+  @Test
+  public void testSendGetRequest() throws Exception {
+    assertThat(
+            connection.sendGetRequest(
+                "/my/path?query", ImmutableMap.of("key1", "value1", "key2", "value2")))
+        .isEqualTo("MyContent");
+    assertThat(httpTransport.method).isEqualTo("GET");
+    assertThat(httpTransport.url)
+        .isEqualTo("https://localhost/my/path?query&key1=value1&key2=value2");
+    assertThat(lowLevelHttpRequest.headers).containsEntry("Cache-Control", "no-cache");
+    assertThat(lowLevelHttpRequest.headers).containsEntry("x-requested-with", "RegistryTool");
+  }
+
+  @Test
+  public void testSendPostRequest() throws Exception {
+    assertThat(
+            connection.sendPostRequest(
+                "/my/path?query",
+                ImmutableMap.of("key1", "value1", "key2", "value2"),
+                MediaType.PLAIN_TEXT_UTF_8,
+                "some data".getBytes(UTF_8)))
+        .isEqualTo("MyContent");
+    assertThat(httpTransport.method).isEqualTo("POST");
+    assertThat(httpTransport.url)
+        .isEqualTo("https://localhost/my/path?query&key1=value1&key2=value2");
+    assertThat(lowLevelHttpRequest.getContentType()).isEqualTo("text/plain; charset=utf-8");
+    assertThat(lowLevelHttpRequest.getContentString()).isEqualTo("some data");
+    assertThat(lowLevelHttpRequest.headers).containsEntry("Cache-Control", "no-cache");
+    assertThat(lowLevelHttpRequest.headers).containsEntry("x-requested-with", "RegistryTool");
+  }
+
+  @Test
+  public void testSendJsonRequest() throws Exception {
+    when(lowLevelHttpResponse.getContent())
+        .thenReturn(
+            new ByteArrayInputStream((JSON_SAFETY_PREFIX + "{\"key\":\"value\"}").getBytes(UTF_8)));
+    assertThat(
+            connection.sendJson(
+                "/my/path?query", ImmutableMap.of("string", "value1", "bool", true)))
+        .containsExactly("key", "value");
+    assertThat(httpTransport.method).isEqualTo("POST");
+    assertThat(httpTransport.url).isEqualTo("https://localhost/my/path?query");
+    assertThat(lowLevelHttpRequest.getContentType()).isEqualTo("application/json; charset=utf-8");
+    assertThat(lowLevelHttpRequest.getContentString())
+        .isEqualTo("{\"string\":\"value1\",\"bool\":true}");
+    assertThat(lowLevelHttpRequest.headers).containsEntry("Cache-Control", "no-cache");
+    assertThat(lowLevelHttpRequest.headers).containsEntry("x-requested-with", "RegistryTool");
+  }
+}
diff --git a/javatests/google/registry/tools/BUILD b/javatests/google/registry/tools/BUILD
index 07954200e..c80ce057d 100644
--- a/javatests/google/registry/tools/BUILD
+++ b/javatests/google/registry/tools/BUILD
@@ -24,6 +24,7 @@ java_library(
         "//java/google/registry/model",
         "//java/google/registry/rde",
         "//java/google/registry/request",
+        "//java/google/registry/security",
         "//java/google/registry/tmch",
         "//java/google/registry/tools",
         "//java/google/registry/tools/params",