Allow user-defined error status of verifyClient

Right now verifyClient can only return 401, but other codes
might be more appropriate, so allow the caller to specify them.