use http.Error instead of log.Panic in handlers