Fix #437 #435

Should be 400 error instead of 403.