Pass custom message to AuthenticationException

…and AccessDeniedException. Preserves the default fallback.