Simplified auth exceptions to just a 401.

For 403 cases they should be thrown in the AuthorizationAware handler.
Added Request::has() method
Fixed exception thrown when RequiresLevel can not be determined