update api authorization message to distinguish between invalid password and no authorization

[volkcj]

Two different messages are returned in the api (Postman) when an invalid password is used and when a user is not authorized. The workbench currently returns the same message when these two cases occur, and it would be helpful to return different messages in the workbench to reflect the different issues.

Message returned when user does not have correct authorization permissions via api

Message returned when password to api is incorrect: