Shouldn't we respond with a 400 or other "bad client request' HTTP status code?