Updated authToken response code to be 401

Looks like 401 is the correct response code for authentication issues:

https://en.wikipedia.org/wiki/List_of_HTTP_status_codes#4xx_Client_Error

It does say the response must include a www-authenticate header which we don't send as it's done via a custom header.

Feel free to comment and close this if you feel 403 is still the correct response.