read settings, send header, send 400 on bad request, and some other things