Move authentication to a dedicated layer

Fixes #87

The layer will return a 403 if the media repo explicitly receives an unknown token error from the homeserver. Otherwise it'll return a 500 upon any other homeserver failure (such as being offline).