REST API: 400s should return regardless of origin…

…so that oauth errors can be caught by developers.

Props @jkudish
Merges r102728-wpcom