Consider throwing BadRequestException in AjaxPageStateNegotiator

Problem/Motivation

Prior to 📌 Compress ajax_page_state Fixed AjaxPageStateNegotiator checked for both theme and theme_token in its :applies method.

Now it doesn't check for the theme_token because this can be unset as well as null (since it may come from serialized JSON).

The behavior preserved in that issue was to silently not return anything if there's a non-default theme requested without any theme token. However, we could consider throwing BadRequestException and present a 400 to the client instead.

Steps to reproduce

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes

Release notes snippet