Make message optional
Use a custom exception, as SuspiciousOperation no longer is propogated
handle suspicious op returned as bad_request
update impacted tests