RFC: 403 error page

Change authz handling to allow 403 handling to filter up to jetty so that it can use servlets error-page.

Add a /error.html error-page to split out terse details.