server/AyaNova/Controllers/UserOptionsController.cs

@@ -60,6 +60,11 @@ namespace AyaNova.Api.Controllers
                 return StatusCode(503, new ApiErrorResponse(ApiErrorCode.API_CLOSED, null, serverState.Reason));
             }
 
+            if (!ModelState.IsValid)
+            {
+                return BadRequest(new ApiErrorResponse(ModelState));
+            }
+
             var UserId = UserIdFromContext.Id(HttpContext.Items);
 
             //Different than normal here: a user is *always* allowed to retrieve their own user options object
@@ -68,11 +73,6 @@ namespace AyaNova.Api.Controllers
                 return StatusCode(401, new ApiNotAuthorizedResponse());
             }
 
-            if (!ModelState.IsValid)
-            {
-                return BadRequest(new ApiErrorResponse(ModelState));
-            }
-
             //Instantiate the business object handler
             UserOptionsBiz biz = new UserOptionsBiz(ct, UserId, UserRolesFromContext.Roles(HttpContext.Items));