in some scenarios you could even go smaller...if you suspect a malicious request theres no point even to return a response code