[web/ajax] don't override any status code with 500 in ajax_error_handler
If the request produced an error such as Unauthorized or NotFound,
core_handle sets an appropriate status_out. Which is then overridden by
the ajax error handler.
[web] Add asserts to the raw header conversion functions
This API is terrible, but at least this might help us catch some errors
in our conversion definitions.