migrated org.fcrepo.auth to org.fcrepo.auth.common to match project name
sends bad request instead of 500 for bad JSON data