[FIX] if wrong hash provided, respond with 400

invalid request