API Handle uncaught ValidationException on controller execution

This removes the need for a lot of boilerplate code
around DataObject->write() logic, and avoids generic 500 errors
on user-level failures which could show a slightly friendler and
more specific error. 

This should really be a per-project choice,
but at the moment request handling doesn't allow to configure
custom exception handling.

FYI, the case I'm trying to fix here is page saving in the CMS failing due to $allowed_children restrictions.