Simply throw `"Invalid collection."` and 400. We do not want to leak who is author of what.