The default error-handler does something like this:
```
        // default to 500
        if (res.statusCode < 400) res.statusCode = 500;
        // respect err.status
        if (err.status) res.statusCode = err.status;
```
And the json-body-parsing thing sets `err.status=400` before throwing it.

It may suffice for us to do something similar here - if there's an `err.status` then treat it as an "expected error" and don't log; if there's no `err.status` then log it and make it a 500.