Updates authorization checks to explicitly respond with a 401 when an invalid token is provided, rather than implicitly downgrading the request to being anonymous. - #30