Flesh out protected_endpoint decorator

I'll continue to add to this pull-request.
You're probably still working on this, but you can define a tuple of exception classes that you want to catch, then use it here:

```python
_INVALID_AUTH_EXCEPTIONS = (MissingAutheHeadersError, MalformedAccessTokenError, InvalidSerialization)

<snip>

        try:
            id_token = self._extract_id_token()
        except _INVALID_AUTH_EXCEPTIONS as e:
            return self.exception_map[e.__class__]
        except:
            LOG.exception('Bad things happened')
<snip>
```