Send HTTP 500 if we end up in render_error without a more specific status.
Add token that is valid except that it points to a missing user.
Move test-api-server framework so it works in functional and unit tests too.
Add tests to expose some token handling bugs.
Fix exception when valid token points to missing user
Merge branch '2388-bogus-token-error-page'

closes #2388