Support Mongoid 3; return 500 on exception

(sorry these are in the same pull-request, there's no easy way to separate them)

* Minor changes to support Mongoid v3 (i.e. Moped v2)

* Currently all exceptions are caught and treated as "401 unauthorized", including database exceptions. However, the semantics of 401 imply that it's the credentials that are invalid and there's no need to retry, when in fact this could be caused by a transient error. Instead, return 500 on uncaught exception.