Maybe return bad_content_type on _session POST

Currently, when POSTing to `/_session` with a Content-Type header
other than either `application/x-www-form-urlencoded` or
`application/json`, the error response can be surprising.

This changes the response to 415 `bad_content_type` when it's not one
of the above.
2 files changed