Use the correct passport strategy callback for failed authentication.

`strategy.error` indicates "Internal error while performing
authentication. ... for example, if the user directory is not
available."

`strategy.fail` indicates "Fail authentication, with optional
`challenge` and `status`, defaulting to 401."

In Koa.js, this is the difference between the client receiving 500
internal server error and 401 unauthorized responses, respectively.
update tests to use `stratedy.fail` instead of `.error`