Passing the second challenge means passing both first and second
The challenge to pass is computed server-side
404 when server is not provided