Distinguish between 401 & 403 return codes

[dvanherbergen]

Currently the Ltpa2Filter.doFilterInternal() method always returns a 403 (user not authorized) error code if something goes wrong. This makes it difficult for clients to know if they should redirect the user to a login page or if the user doesn't have access the service in question.
It would be great if this method could return a 401 (user not authenticated) error code in case the ltpa token has expired or is invalid, since the user is not know at this point and should be considered not authenticated.

PS. This library is awesome. I've been testing it and it works great. Nice work! 👍