fix location header missing on bad requests