return http 400 for missing user