return a better error message + http 400 on malformed JSON
slightly better error message