Authentication errors don't throw errors, instead modify the status and response body directly.

[brocoli]

In Operation.js line 315, notice how the code sets a message in the response body directly. This makes it hard for applications to format the error response, for instance, if we need to always return RFC 7807 Problem Details for HTTP APIs.

Since the rest of Exegesis already has an HttpError type defined and even an option parameter that controls whether Exegesis should handle the conversion of these errors into HTTP error responses, shouldn't the authentication process also use this code flow?

It would avoid creating extra code in our applications specifically for 401 responses.

[jwalton]

Sounds reasonable to me. I'd welcome a PR. :)