Make auth interfaces more flexible

Allow AuthenticationNeeded/GrantNeeded interfaces to decide whether to handle the request, or let the default error response be written by the oauth server
In a lot of these cases where you're returning an error you shouldn't glog.Errorf() anymore