user-routes - should have malformed payload with invalid user