Deal with invalid authentication tokens instead of returning 500.