400 is an "invalid request"; Wouldn't 422 "unprocessable entity" be a better fit?