Services REST: Response code 401 Unauthorized for missing arguments should be 400 Bad Request

Well.. that was certainly fast to get attention and eyes on it: Thank you! I can also appreciate the challenge with maintaining existing implementations. A very-Drupal workaround could be $conf or variable preference, settable to future 400, defaulting to existing 401 behavior. How rigid you make it (fixed 400/401 toggle vs a free form nnn code) is something else to consider.

The attached patch against master (which I believe to be 7.x-3.x-dev?):
* Out of the box responds with 401 Unauthorized (no change in behavior for existing users)
* Provides a $conf['services_deprecated_missing_arg_code'] allowing a concerned user to set to 400 (Bad Request)
* Provides comments in code about this and how to implement

Plan to obsolete this crutch in 7.x-4.x or as you see fit.

Woops - Attached is better. Using variable_get() seems more appropriate and still (as before) allows variable_set() and $conf manipulation in settings.php just the same.

Thanks for your reply @kylebrowning. I think I get what you're saying, and I thought so, too, at first. Then I took a look under the hood to see what's what. The variable_get() function is doing exactly what I did before but without me having to clutter your codebase with a stray global $conf; in the middle of a function call:

function variable_get($name, $default = NULL) {
  global $conf;

  return isset($conf[$name]) ? $conf[$name] : $default;
}

The only overhead with variables occurs when they're first -all- loaded from db into the global $conf array at some point in bootstrap. Recall that we can still set the value for this conf/variable either by vset or from $conf in settings.php. Here's more:
https://drupal.stackexchange.com/a/187670