title: What is the most appropriate HTTP status code to return if a required header is missing?
body: <p>I read <a href="https://stackoverflow.com/questions/3050518/what-http-status-response-code-should-i-use-if-the-request-is-missing-a-required">What HTTP status response code should I use if the request is missing a required parameter?</a> but it did not specifically ask about headers and there didn't seem to be a consensus.</p>
  
  <p>The context of this question assumes successful authentication.  I'm currently favoring either a 400 (though that doesn't feel right because this isn't really a case of "malformed syntax") or 403.  Given 403's description:</p>
  
  <blockquote>
    <p>The server understood the request, but is refusing to fulfill it.
    Authorization will not help and the request SHOULD NOT be repeated. <strong>If
    the request method was not HEAD and the server wishes to make public
    why the request has not been fulfilled, it SHOULD describe the reason
    for the refusal in the entity.</strong></p>
  </blockquote>
  
  <p>This makes the most sense to me.</p>
  
  <p>Can someone please enlighten me?  Thanks.</p>