rename invalid request error to bad request error
return 400 on failed auth