Change invalid_token to 401 (Fixes #5)