Add 400 error status to exception handling in mfa/FIDO2.complete_reg

Proof of concept, for testing purpose I added some random bytes to request body to check if exception handling is returning properly 400 status code and then for the same reason I removes fido_state from request.session dict to test if the first exception handling returning 400 status code.

I found more missing status=400 places in code, will update the pull request soon