Handle unauthorized errors

Resolves #59. However, doorkeeper doesn't properly handle 403s where a user has a valid token, but the incorrect scope to access a resource. I'm working on a patch to fix that.
Yes, Pundit errors should be 403s.