Use an HttpResponseBadRequest to return HTTP error

Even with status=400 we were seeing 200 responses coming back from
nested module updating. Everywhere else we use HttpResponseBadRequest
to indicate a 400.

Fixes #264