Earlier quoted context omitted.
500-series errors are server-side, 400 series are client side. A 500 error is almost never "just you". ( 404 is a client error, because it's the client requesting a file that does not exist, a problem with the client, not the server, who is _obviously_ blameless in the file not existing. )
> A 500 error is almost never "just you". I know you added the defensive "almost" but if I had a dollar each time I saw a 500 due to the session cookies being sent by the client that made the backend explode - for whatever root cause - well, I would have a fatter wallet.
Bad input should be a 4xx, but if the server can't cope with it, that's still a 5xx.