Fix / Logging in with expired tokens does not work

[thekevinbrown]

• Now treating users with expired tokens as guests instead of throwing
• If this error occurs while successfully logging in, there's no need to redirect to the login, so we no longer do.
• To achieve this, there's a new flag in context that a resolver can set to avoid the redirect to login specifically in the case of token expiry.
• This PR also resolves information disclosure in errors in the API key authentication module, instead logging the reason for the rejection.