Actually 403 won't occur, but 400 will, updated docs and tests accordingly.