Use 'unauthorized_client' error

This clarifies the difference between authentication and authorisation
errors