All services need to return 502 if the Auth service is unavailable

[amrc-benmorrow]

Currently all services which authorise requests against the Auth service will return 401 responses if the auth service is unavailable. This was implemented for safety; the check-acl function returns access-denied just in case.

This is causing problems. Services should return a 5xx error instead, probably 503 Service Unavailable.