Update extractor to be in line with spec

See: http://tools.ietf.org/html/rfc6750#section-3

which recommends that an invalid token have a 401 response.