Add spec for malformed JSON

The default rails middleware (`ActionDispatch::ParamsParser`) handles malformed
JSON in the way that we need (returning status code 400). The only nuance is
that the rails testing hooks appear to raise exceptions rather than return 400
in this case, making the spec less clear than it could be.
It does do the same thing in dev. I was just going on Alex's wording. Changed again. :-)