server: return JSON errors, correct HTTP status code on error