Catch InvalidId exception to return 401, not 500

Fixes #23

If a provided API token isn't in a valid MongoDB ObjectId format, an
InvalidId exception is thrown. This results in an HTTP 500 response
rather than the appropriate HTTP 401. When we catch this exception, we
can return the appropriate response.