Return 500 on exception

Currently all exceptions are caught and treated as "401 unauthorized", including database exceptions.  However, the semantics of 401 imply that it's the credentials that are invalid and there's no need to retry, when in fact this could be caused by a transient error.  Instead, return 500 on uncaught exception.