I think we return an error object in the response. Since the client might use that object to present an appropriate message to the user, should we test for it here?

(similar for 400 error tests below)