Presumably this should list 400 for the invalid case going by https://github.com/mozilla/webpay/pull/406/files#diff-db6f9ecccb2132c3a26e76a68c269c47R76?