Idiomatic error handling for requests

Right now I have a weird thing where I have a function that checks for auth errors, and replies to the request with a json error and otherwise returns a token. I probably want to return an error, but I didn't want to have a lot of boilerplate in the handler.

I could probably create a new error type that automatically becomes a json. And a different variant for 500s, since the error should not be output to the user, but rather logs instead (as I do now but in a less idiomatic way).

No file, test, or entry point is named. Start by locating the request handler and its auth-checking function, then trace how token success, JSON auth errors, and internal 500 errors are currently handled and logged. Done means the handling is idiomatic, avoids repeated handler boilerplate, returns appropriate JSON for user-facing errors, and keeps internal errors out of responses.