"jwt" authenticator returns 403 instead of 401

[ngrigoriev]

"jwt" authenticator returns 403 instead of 401

From what I see in the code, "jwt" authenticator return 403 (StatusForbidden) in case of authentication failure. I would expect 401 (StatusUnauthorized), the documentation actually says 401 too.

Reproducing the bug

1. Access a protected resource with an expired token

func (a *AuthenticatorJWT) Authenticate(r *http.Request, config json.RawMessage, _ pipeline.Rule) (*AuthenticationSession, error) {
...
        if err != nil {
                return nil, helper.ErrForbidden.WithReason(err.Error()).WithTrace(err)
        }

Expected behavior

401 status is returned instead (e.g. the token is not valid).

Environment

• latest/master

[aeneasr]

Yes totally, would you be up for a PR?