Use exceptions consistently for error conditions in controllers

[alexweissman]

In https://github.com/userfrosting/UserFrosting/commit/32e646521e6a3e90685a5661580cbcb751bb15b6, we addressed #757 so that invalid JSON is no longer being returned in responses. However we are still returning a hard-coded response in some places, but throwing exceptions in other places. In the case of error status codes (so anything except a 200) we should consistently throw exceptions (BadRequestException, ForbiddenException, etc). We may need to introduce a RateLimitExceededException for the 429 errors.

This way, exception handlers can be used to alter the behavior for these conditions in a consistent way.