Simply throw `"Invalid collection."` and 400. We do not want to leak what is in a collection.