Use bad request when passing invalid access token