This is something that I brought up also in BjyAuthorize: we should stop setting errors. Instead, let's just throw an `UnauthorizedException`: cleaner and can be handled by the exception strategy anyways.

`setError` is not needed (or at least doesn't need a custom value)