Expired tokens should return 401

An expired JWT should return a 401 so the end user/client knows that they should re-authenticate and try again.