Once the `ValidationError` struct has json field tags, we can serialize it directly. Ideally all errors from HTTP handlers should be routed through a single function so that it can choose to report them to the client or to 500 and log them. Also, we use 400, not 422 as it isn't in RFC2616 or any generic HTTP RFCs (it's from WebDAV).