Report empty /authorize requests as 400s