[FIX] http,ir.http: refactor exception handling to allow request-specific handling

Typically an exception during a JSON-RPC request must be
handled specifically and return a JSON-RPC error in all
cases. Previously the _authenticate() step could fail
during ir_http.dispatch() and bubble up to werkzeug,
yielding a dumb "Internal Server Error 500" even for
a JSON-RPC request.