JWT mode returns multiple unauthorised responses types

How is one supposed to catch unauthorised responses ? There are (to my knowledge) three types of errors when authentication isn't what's expected :
**No token is passed**
```
{
"errors": [
{
"extensions": {
"code": "validation-failed",
"path": "$.selectionSet.XXX"
},
"message": "field 'XXX' not found in type: 'mutation_root'"
}
]
}
```
**Malformed token**
```
{
"errors": [
{
"extensions": {
"code": "invalid-jwt",
"path": "$"
},
"message": "Could not verify JWT: JWSError (JSONDecodeError \"Not valid base64url\")"
}
]
}
```
**Invalid JWT Signature**
```
{
"errors": [
{
"extensions": {
"code": "invalid-jwt",
"path": "$"
},
"message": "Could not verify JWT: JWSError JWSInvalidSignature"
}
]
}
```
**All of these are 200 responses** : how can the client (i.e Apollo) setup the refresh token rule with these ? Shouldn't they all be 401 in the end ?
Related to [8659](https://github.com/hasura/graphql-engine/issues/8659)

Start with the JWT mode behavior described in this issue and the related issue #8659. Compare the no-token, malformed-token, and invalid-signature examples, including their HTTP status and GraphQL error codes. Done means the expected unauthorized response behavior and Apollo refresh-token handling are clearly established.

Written by the indexing model from the issue text.