Throw 403 for ToU exceptions

If a user must sign the terms of use, the status code should be 403, not 401.
Also fixes the /registeringUserPassword method, which should not require ToU acceptance

This change is to comply with the specs found at https://sagebionetworks.jira.com/wiki/display/PLFM/Authentication+and+Authorization+API