Added missing @login_required decorators.

(Oops)
Added more specific 400 responses
fixups