Return 404 instead of 401 in release mode

[chunningham]

401 messages give away quite a bit of information. In production, this should be sanitized or converted to a 404 message.

[grdsdev]

If the API returns 401 the client side can provide a better UX, like automatically initiating the refresh flow.

Can't we just return a generic message on the 401?