The spec says that the hello message must pass channelIds that is knows about or an empty list. Currently, we allow the channelIDs field to be missing.

Looking at the Go SimplePush implementation they return a 401 "Invalid Command" which seems a little odd to me. For other error codes the HTTP response status codes have been used, but in this case it does not seem to match. A HTTP 401 is the "Unauthorised" response code. For our implementation, I'd rather go with a 400 "Bad Request".
I'll ask the Mozilla developers about this and see what their advise is.