Fail with `invalid_token` if a Bearer token was provided, but was not located

In contrast to current behavior a 401 status code will be set if a token is sent, but was not found.