error handling: send BAD_CREDENTIALS when a login required/logged out error occurs

[sumnerevans]

Signed-off-by: Sumner Evans sumner@beeper.com

[tulir]

Just realized that this will also conflict with the normal auth checks (like checking if the user is logged in) 🤔