responses.go

Standardize on structured JSON error responses everywhere we can, with
only one exception where the error is a warning for humans to read.

Fixes #108 by adding a check to every request in the test suite to
ensure that errors are never served with a Content-Type that might
enable XSS or other vulnerabilities.

While we're at it, continue refining the test suite and further adopting
some of the testing helpers added in #131.