returning a 404 instead of 400 for invalid tokens