Distinguish between AuthenticationError and AuthorizationError

[lordi]

Is your feature request related to a problem? Please describe.

Right now, when a user is authenticated but lacks permissions, I raise AuthenticationError. This is not totally correct, because it returns 401, but for authorization failures I expect 403 (Forbidden).

Describe the solution you'd like

I suggest to add another exception to ninja.errors that specifically denotes an Authorization error and results in a 403 response.

[c4ffein]

@vitalik @lordi I made #1257 which should answer that need, please tell me if anything is missing
I'm still not sure this is the right way though, maybe the user should just return 403, {something} instead