Add Signon reauth route

Simply remove it from the cache so that subsequent requests require a
trip back to singon.
Split out forbidden from unauthorized responses

- Unauthorized when the user has not presented valid credentials - invalid
  token.
- Forbidden when the user is not allowed to perform the action they tried
  - insufficient permissions.
- Provide WWW-Authenticate header for unauthorized responses.
- Add a permission requirement test for the user detail resource.

This is more correct and allows us to distinguish more accurately in the
admin app and therefore not clear the user's session just because they
didn't have permissions to something.
User is unauthorized after a valid reauth request.