createToken's catch-all answered 400 for every unmatched error, so a database failure reported itself as the caller's malformed request. Found in review of Task 7.