Ah, yes, I actually have that book and had forgotten about the detailed discussion of error codes in the appendix :) I also considered using 409 ("Conflict") for some cases (like where you try to upload an older version), but it's probably fine to keep it simple and just use 400 in non-auth cases.