Better server-side form validation error handling.

The server-side form validation is a last resort, but (at least on
badge creation and update) ValidationError responses from mongoose
now return a 422 Unprocessable Entity response with human-readable text,
instead of a 500 with a stack traceback (or nothing, in the case of
production instances).

Coincidentally, this also appears to fix #96, "raw PNG written to console".