Probable DDoS vulnerability

[AlbertoLeon]

When a negotiate end point expects UserId binding in headers for example {headers.x-ms-signalr-userid} but it is not present, the end point responds a 500 InvalidOperationException instead of a BadRequest.

This could overload the server handling the error and logging the strack trace and all that stuff.
Apart of taking so mutch time to respond, what impacts negatively in performance.

A proposed solution could be to respond BadRequest with the message "A required header is missing for binding purposes".
Then log in appropiately on Application Insights with the message:
An attemp missed the header x-ms-signalr-userid required in Binding UserId.

[Y-Sindo]

The resolution of {x-ms-signalr-userid} utilizes some codes provided by https://github.com/Azure/azure-webjobs-sdk. Could you please open an issue in the project?