pass any existing http status code through, otherwise default to 500 (in...

...ternal server error)

Without this change I find that it always returns 200 on both code generated errors (bad csrf token for example) or even 404 page errors.