Ability to return 401 and 403 response codes #301

added app and model settings `aclErrorStatus`
default to 403 on ACL Error
added tests
Signed-off-by: Karl Mikkelsen <karl@karlmikko.com>
Makes sense. Would you mind extracting this code into a shared methods, so that the error message remains the same in the future too? E.g.

```js
Model.notFoundError = function(id) {
  var err = new Error('could not find a model with id ' + id);
  err.statusCode = 404;
  return err;
}
```