The return value of _prepare_draft is assumed to be a ReviewRequestDraft,
when it could be an error. This can lead to problems if some other user
attempts to call such an API function. A draft won't be manipulated, but an
HTTP 500 will be generated, since we'll attempt to call functions on an error.
_prepare_draft doesn't even seem to be smart about returning an existing
draft for a review request, which confuses me, but really this logic should
either go into the create method in a Manager for the draft or we should
provide a create_draft() function on ReviewRequest. In either case, an
exception should be raised if the user doesn't have the right permissions.
We should then catch it and return the proper webapi error.
