return 400 when request is invalid