Unexpected Auth interaction

I have noticed a peculiar interaction with using the `Auth` API part. Even when you use a `ReqBody` afterwards in that same endpoint, the `Auth` handling will be done AFTER the `ReqBody` has been parsed/transformed. i.e.:

```haskell
type MyApi = Auth [JWT] MyFields :> ReqBody '[JSON] MyBody :> Post '[PlainText] NoContent
```

In this case, even when the JWT fails to verify or when the header isn't even present, the endpoint will FIRST reply with 400 BAD CONTENT responses until the JSON is parsed correctly, and THEN the 401 UNAUTHORIZED I throw when the result of `AuthResult` is not `Authenticated`.

Is this the expected behaviour? Because from a security perspective, I would like to not leak my data format to any person that knows (or stumbles upon) my endpoints.

I would expect that it might work that way when you define `ReqBody :> Auth`, but even then I'd prefer the Auth to be checked first.

Start with the Auth, ReqBody, and AuthResult handling described by the MyApi example, and reproduce requests with a missing or invalid JWT and malformed JSON. Check whether the current behavior is intentional; done means either authentication is evaluated before body parsing or the ordering is clearly documented.

Written by the indexing model from the issue text.