Better API token parse error reponse

I made a typo when copy/pasting an API token (removing a trailing `=` character) and the API responded with a 500 error to an auth_check call:

{"success":false,"error":"InternalError","message":"unexpected internal error: invalid length at 196"}

This should be a 400 error (not 500), and the message should indicate the actual problem.

Start at the auth_check API entry point and reproduce the malformed-token request described here. Trace how the invalid token length error is currently converted into the 500 response. Done means malformed API tokens return HTTP 400 with a message describing the actual token problem.

Written by the indexing model from the issue text.