Return 403 on unauthorized
Add 400 on no payload