We'd return a 500 when the token isn't found on the homeserver, but we should be returned a proper auth error. This just fixes the logic around the area to make that actually work.