api: return JSON-formatted 400 responses

Include an error message as well.