I think this should be a 400 "bad request" rather than a 500.