bad requests now return 400 or 500 response codes