Better HTTP error statuses

# What's New?

 * If a user performed an unauthorized action, we were sending a 422 rather than a 401.

# What's Next?

 * Probably token auth expiration handling