Return 400 instead of 403 when missing X-FromAppId