using HttpException with 400 instead