Split out forbidden from unauthorized responses

- Unauthorized when the user has not presented valid credentials - invalid
  token.
- Forbidden when the user is not allowed to perform the action they tried
  - insufficient permissions.
- Provide WWW-Authenticate header for unauthorized responses.
- Add a permission requirement test for the user detail resource.

This is more correct and allows us to distinguish more accurately in the
admin app and therefore not clear the user's session just because they
didn't have permissions to something.
User is unauthorized after a valid reauth request.