bad request if user do not exists