get context catches 403s and returns a context with no user

This doesn't propagate the 403 in any way. It seems like an odd state to be in where they have an oauth session, but they do not have access to the resources on stagecraft, but we do not want to tell them that.