changed all RuntimeException to HttpException with a bad request status code

fixes #396