Raise BadRequest if JSON decode fails (closes #1053)

Previously anything which caused an error in the underlying
`simplejson.loads` call was not caught. Now ValueErrors are converted
into BadRequest so they'll generate an HTTP 400