HTTP 403 not 401 when the bearer token is missing

It's more appropriate to return a 403 than a 401 if there's a bearer token problem.

See http://stackoverflow.com/a/6937030