fix error codes returned to client on failed challenges

anarcatrequested to merge
400 into main

500 signifies there's a problem with the server, but this is not actually the case here: the client has provided invalid data.

Merge request reports