Change 200 to 400 when session/identity not found
 - add "WARN" logging when either occurs