Return meaningful responses

[gmkohler]

We should return 401's if auth tokens aren't provided in headers, or if they're invalid. We could return 400 responses for incorrectly-structured responses but sounds less important given the app endpoints aren't meant to be public.