Handle authorization errors more gracefully

[lfilmeyer]

Currently when you make a request to an endpoint and are not authorized, we throw a Pundit::NotAuthorizedError 500 error. We should instead be returning a 401 error