Return 400 instead of 403 when missing X-FromAppId

No match.