accounts/ajax/users should return a 400 on an invalid request.