Use 422 rather than 400

400 should be for a malformed HTTP request, which isn't the problem. Whereas
422 is for a semantically invalid request, which is what we're trying to
describe.