Malformed authorization request returns 401

[scytherswings]

If the Authorization header is present but the user lookup fails, we still return a 401, with a non-helpful message. We should tell them the request was malformed

[scytherswings]

nope. Do auth correctly.