This method is duplicated in Authorization server, along with `getExceptionType` and `getExceptionHttpHeaders`. Should I abstract these in some why? If so, do you have a preferred class name?