Check Errors on JSON Decodes, in server-side API handlers

[jhunt]

We have code like this all over:

var params struct {
  /* some structure def */
}
json.NewDecoder(req.Body).Decode(&params)

// use `params`, without checking for bad JSON formatting, non-JSON input, etc.

We should handle errors from the JSON decoder, as 400 Bad Requests.