Tested and now returns 400 Bad Request instead of 403 Forbidden.  Looks good.