Better error if Authorization header missing

Rather than just issuing "Forbidden", which isn't very helpful.
Merge pull request #250 from alphagov/more-helpful-error-message

Better error if Authorization header missing