ROPC with REST API/Dictionary reads as first step - returns 200 with HTML Response

[dave22000]

I have two copies of an ROPC policy

1. Has the standard sample of ResourceOwnerPasswordCredentials-OAUTH2 as the first step, the rest of the provided sample as steps 2 and 3, and correctly returns a 200 with the tokens, or a 400 on Bad U/N or bad Password

2. Has additional logic for seamless migration (as described https://github.com/azure-ad-b2c/user-migration) which involves looking up a user's info in the dictionary, checking migration status, and then calling REST APIs to complete password migration. Once fully migrated, it calls the same exact ResourceOwnerPasswordCredentials-OAUTH2 profile, and returns a 200 with the tokens if successful, BUT, responds with a 200 with an html page containing an error message, rather than a 400 error.