without the sanity check returning a 400 early, we would do 3 requests on the hash url on a hash expose attempt, until the accept header is lost and then return something without the hash header.

i want to keep this in to prevent against such a mess ever to happen.