How should a JSON POST endpoint separate client errors from server errors?