Improve API error codes

User story

As a user that is making a request to the JSON API with an invalid token, I would like to receive a 401 response, so that I know that I've got an authentication issue, and I can resolve the problem faster.

As a user that is making a request to the JSON API with invalid data, I would like to receive a 400 response, so that I know that I've got an issue with my request data, and I can resolve the problem faster.

Details

Currently, the JSON API returns a 500 error code if the authentication token is incorrect.

We should be adding the following error codes to the JSON API:
400—Bad Request.
401—Unauthorized.
403—Forbidden <-- @stuartc do we have any POST requests in our JSON API yet? If not then there would be no need for 403 at the moment.

Implementation notes

Release notes

• Add authentication and bad request error codes to the JSON API

User acceptance criteria

• When I make an API request with an invalid token, I receive a 401 error code
• When I make an API request with a valid token and valid data, I receive a 200 response
• When I make a request with a valid token but invalid data, I receive a 400 response
• When I make a request with

The issue names the JSON API but no files, tests, or entry points; start by tracing how it handles invalid tokens and invalid request data. Done means invalid tokens return 401, invalid data returns 400, valid requests retain 200, and the need for 403 is resolved based on current POST support.