Add support for specifying HTTP status codes on errors.

This change introduces proper HTTP status codes for the various errors we
send out.

This will break backwards-compatibility if a client assumes that every error
type is going to be a 200 OK. It's a bad assumption in general, but sadly,
is made in post-review (which will soon be fixed).