Catch expired token 403

This all works and is better I think. We will still add a proper expiry in tim's redis session stuff but this will catch edge cases I hope.

One controversial thing I did was remove alot of the HTTPMock stuff and make this explicit in patches (only in the data set route does this make a difference though, it should be noted). I left it in the status tests but I'm having problems with it when I'm not on the vm - it matches the dependant app urls and send responses but hangs massively in the process. Is anyone else having trouble on their host machine? My VM is a bit broken it seems at the moment so this is how I've been developing.