title: Correct HTTP code for authentication token expiry - 401 or 403?
body: <p>401 seems to be used to indicate an authentication failure whereas 403 for an authorization failure (which means authentication succeeded?)
  In case of an oauth flow if I try to authenticate with an expired token what is the right error code that prompts the client to refresh the token and try again?</p>