Use 4xx status codes for CLIENT_ERROR and INVALID_CSRF_TOKEN.