Set bad request status to 400, catch exceptions from verify callback.