Invalid requests to /appmanagement cause NPE and HTTP error 500

A request like GET http://localhost:8095/crowd/rest/appmanagement/1/aliases/2/alias causes a NPE and returns 500 because it is missing the required parameter username.

Crowd should not throw NPE and it should respond with a 400 instead.