fixed middleware

 and updated tests to reflect bad requests (400 errors on bad input)