Changed JSON exceptions’ status code.

According to the OAuth2 specification, when issuing an access token,
“The authorization server responds with an HTTP 400 (Bad Request)
status code (unless specified otherwise) […]”.