added error handling

Instead of sending errors with `res.send(400)` altered to match the changes in controller here: https://github.com/endpoints/controller/pull/2

Also changed unauthorized `isAdmin` and `isAuthenticated` to return `401` codes, not `403` to match `Unauthorized` rather than `Forbidden`.