POST /v1/actions with "user_id" specified in body silently overwrites user_id in stored action

Looking at the API-WG guidelines on this, "If a request contains an unexpected attribute in the body, the server should return a 400 Bad Request response".
In the case of an action in freezer, "user_id" is such an attribute because it'll get overwritten with the user id pulled from Keystone based on the provided auth token, so if the user passes the user_id as a parameter the API _should_ return a HTTP 400 response rather than silently overwriting the value.