Separate user and server errors in http handlers

[kradalby]

At the moment, all errors that occur in http handlers, particularly the registration handlers, will end up as a "internal server error" or "bad request" giving the user very little information about what went wrong.

Some times this is correct when there was some unactionable server side issue, but some times it is within the users power to do something and they should get an error, for example if a token or registration key has expired.

We should make a separate Go error type for user web errors that we can check at the end of all paths to surface to users.