set custom error response content for 401/403 errors

So the approach here is that, in our `Auth_persona_check_cookie` function, which is registered as a `check_user_id` hook, if the user has a correct cookie and let in (aka is authenticated), we set a custom error response for 401 or 403 errors. These override any custom `ErrorDocument`s the user has set up, but I think it's still a pretty big net win, since this will subsequently show a nice Persona error page with a custom error message for any failed authorization (e.g. `Require persona-idp`, but also `Require user` even if we stop handling it ourselves).

@lloyd r? @gene1wood want to test this?