Avoid returning HttpServerError for things not server errors

Avoid returning HttpServerError for things not server errors

With the new django, alerts are raised for everything with status 500,
not juse exceptions. This put a light on a number of places where we
were returning 500 server error code for things that are not actually
server errors. Some should be a regular 200 ok with an error message,
and others should be a permissions error.