catch invalid / blacklisted publishers earlier, to avoid a round-trip with the change api (that will fail since we're not signing the profile)
catch invalid / blacklisted publishers earlier, to avoid a round-trip
with the change api (that will fail since we're not signing the profile)

That way we don't even try to send it as we know it's invalid

mozilla-iam/cis,mozilla-iam/cis