We'll need a test that nails down what the behavior is for failed assertions.  

We might want to respond with HTTP code 400

Presumably, we'll want to return HTTP result code 400, presumably with the error string in the explanatory HTTP entity, appropriately escaped.  That might be sufficient.  Not sure if it's worth returning anything in the document; maybe the Persona best practices & security docs have a relevant guidelline?

Similarly, the front-end code needs to have tests and implementation that handles any such errors in a reasonable way.