Return 400 when no auth_code is present