ActionController::InvalidCrossOriginRequest fails with 422 instead of 500
Fixes #15967