After some debugging.
It seems the library does not reject and cannot verify requests without content type. After adding content type the library correctly spots all kind of errors.