Add spec for malformed JSON

The default rails middleware (`ActionDispatch::ParamsParser`) handles malformed
JSON in the way that we need (returning status code 400). The only nuance is
that the rails testing hooks appear to raise exceptions rather than return 400
in this case, making the spec less clear than it could be.
`In production` implies that this does something different in development. If it always translates to a 400 status code, why not say `This exception will translate to a 400 status code`?