authenticate before parsing anything
tests for badly formed requests