Improve error handling of invalid OAuth token

Previously we would respond with a 500 HTTP response
when presented with invalid credentials. This is incorrect,
since the server is not at fault, but the request. By
returning no user when we receive a 401 from Google, we'll
deny the request if it's a protected URI.