improve api server auth messages

[gabemontero]

As part of some initial consumption of the new impersonation feature, we discovered the opportunity to improve on the errors reported back to the end user, to better facilitate determining why authorization failed.

I will put up a pull request shortly with some additions to the errors that are returned.

[gabemontero]

@sayan-biswas @avinal @enarha @adambkaplan