mrhid6
2685e9ad06
createToken's catch-all mapped every unmatched error to 400, so a database outage reported itself as a malformed client request. Wrap the genuine validation failures with ErrTokenInvalid and let the handler answer 500 with a fixed message for everything else.