Fix inconsistent status codes

Two exceptions were handled differently by the API layer (which let the
exception handlers determine the status code) and the middleware used by
the frontends (which used the "code" that was set when throwing the
exceptions).

When extracting the logic, I mostly used the exception codes, which
now changed the behavior of the API, e.g. when raising a "permission
denied" error when incorrect login credentials were entered.

The other case was the CSRF token mismatch - the frontend used the 419
status code (inspired by Laravel, I suppose), whereas the API (which was
covered by tests) used HTTP 400.

src/Foundation/ErrorServiceProvider.php

@@ -31,11 +31,11 @@ public function register()
 
                 // 401 Unauthorized
                 'invalid_access_token' => 401,
+                'permission_denied' => 401,
 
                 // 403 Forbidden
                 'forbidden' => 403,
                 'invalid_confirmation_token' => 403,
-                'permission_denied' => 403,
 
                 // 404 Not Found
                 'model_not_found' => 404,