🐛(api) return a 403 HTTP status upon authentication failure

[jmaupetit]

Purpose

When an ID token expires or is invalid, we should respond with a 403 status and an appropriate error message instead of a 500.

Proposal

• [x] integrate a custom exception handler for authentication failures
• [x] tests all possible failures