WSGIPassAuthorization needs to be on

not sure why it is commented, but in production it must be uncommented
otherwise backend will be unable to auth
fix typo in exception message printing

regression caused by f005609b