HTTP 400 if canned acl and header grant specified