Better error if Authorization header missing

Rather than just issuing "Forbidden", which isn't very helpful.