Perhaps this should have a default that sets BAD_REQUEST on the request instead of succeeding?