Use 401 status code for some OAuth 2 errors

Errors related to failed authentication or related denied access should IMO default to 401 status code. The OAuth 2 spec (see §5.2) only explicitly specifies that the invalid_client error may (and actually MUST when using the "Authorization" header) return a 401 status code, while it currently returns 400 in oauthlib. This changes that default.

Depending on how strict interpretation of the spec you want to follow, I also suggest using the 401 status code for some other errors, which I find is much more relevant for clients (in fact, some clients seem to expect 401 for API calls related to authorization). You already did use the 401 status code for the invalid_scope error, which is technically supposed to use a 400 status code according to the spec, so.... :)