Support handling expired/revoked tokens

[jamietanna]

Something that's been discussed a bit in the past, and we're starting to see more adoption of, is expiring tokens in IndieAuth.

This would see an IndieAuth Resource Server, in this case the Micropub Server, returning HTTP 401 or HTTP 403s for bad authentication sent by the client, in the case that the token is no longer valid.

This would require handling these errors, and sending the user through a fresh authorization journey to receive new tokens.

---

As we're starting to see servers supporting this, it'd be good to have one of the more popular clients supporting this!

---

Related reading:

• Adopt Expiration and Refresh Tokens into the Spec indieweb/indieauth#81
• Clarify error for ie token expiration indieweb/Micropub#5
• What is the appropriate error response for an invalid authentication token? w3c/Micropub#107