4xx instead of 5xx for bad API calls

There are a range of situations where the API returns an 500 response where a 4xx would be more appropriate.
- Try to reassign an existing ID
- Try to fetch a viewconf which does not exist

DB Errors are being thrown internally and we don't catch them. We want to catch these and handle them correctly.

(I think we do not want to do pre-flight queries: that would be vulnerable to race conditions.)