IIRC, `base64.b64.decode` will raise a `TypeError` if the string is not properly encoded. we should probably catch these exceptions and return a 400