Agreed.  We should be sending 400 in the `authenticationHandler` if this is missing.