maybe this should blow up with a 400, so the client can show an error.