core/apiRouter: properly wrap errors on authentication failure