should catch any `JSONDecodeError` and give a 400 error to caller