return JSON for token auth fails as well as permission issues

WIP