ensure return 400 when no id passed to a get or post - no need to hit database