401 improvement

[smebberson]

Describe the problem you'd like to have solved

I'd like to improve the integration of this library when it comes to 401 responses.

Describe the ideal solution

The README clearly states that The idea is that you will use another mechanism to validate the user first.

However, I think that return res.send(401); should be updated to actually call a default function. Then when configuring this library via auth, you can pass in a function to override the default handling.

This is line with how the library works when it comes to customising handling.

Alternatives and current work-arounds

The current work around is to have some extra middleware that runs before this one to validate the user first. However, I feel that looses a bunch of context when working with auth, and I feel that solution is more inline with how other parts of auth work.

Additional context

I'd be happy to provide a PR if this is something you're interested in.

[luuuis]

Related to #88