User settings

This is a pull request for issues #455 and #456.

Is it really necessary to pass 400 to `ValidationError`? We could just make `ValidationError` always use 400. :-)