Safe api errors (needs triaging)

This is dependent on #329 .  Needs triaging--could be 0.10 (cleanup / more robust UI) or 0.11 (as it's a major behavior change)

Background:
* API and browser-based requests have different expected behaviors.  For example, browser-based requests should always return HTTP 200 responses, with content appropriate for different errors ("server error" page for server errors, login page for unauthenticated errors).  The API, however, should never return HTML (unless explicitly expected), but instead use HTTP status codes and content to give information about the error, authentication status, etc.

Change:
* I implemented a generic decorator for APIs that basically wraps the code in a try/catch block, and returns a Json blob on any uncaught exception (other than a PermissionDenied error)
* I made changes to all API calls in video_download.html to now receive "fail" errors, and handle them appropriately.

Testing:
* I tested many of the API calls by running commands in the update page while logged out (right-clicking "logout", and choosing "open in new window", to cause 403 errors).  I also modified code (temporarily) to force opening of 500 errors.