Throw WebApplicationExceptions to get proper HTTP responses.  Refs #2395

Change-Id: I37fd4d7e13a3a3781e81975a19ba48df42397e10