Rework handling of authorisation errors.

We'd sometimes return "Internal server error" on authentication
failures.  This should be gone now.

webserver/webserver.go

@@ -132,8 +132,10 @@ func httpError(w http.ResponseWriter, err error) {
 		notFound(w)
 		return
 	}
-	if os.IsPermission(err) {
-		http.Error(w, "Forbidden", http.StatusForbidden)
+	var autherr *group.NotAuthorisedError
+	if errors.As(err, &autherr) {
+		log.Printf("HTTP server error: %v", err)
+		http.Error(w, "not authorised", http.StatusUnauthorized)
 		return
 	}
 	var mberr *http.MaxBytesError
@@ -230,7 +232,8 @@ func (fh *fileHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		if err != nil {
 			// return 403 if index.html doesn't exist
 			if os.IsNotExist(err) {
-				err = os.ErrPermission
+				http.Error(w, "Forbidden", http.StatusForbidden)
+				return
 			}
 			httpError(w, err)
 			return
@@ -706,7 +709,8 @@ func checkGroupPermissions(w http.ResponseWriter, r *http.Request, groupname str
 		}
 	}
 	if err != nil || !record {
-		if err == group.ErrNotAuthorised {
+		var autherr *group.NotAuthorisedError
+		if errors.As(err, &autherr) {
 			time.Sleep(200 * time.Millisecond)
 		}
 		return false

webserver/whip.go

@@ -219,11 +219,7 @@ func whipEndpointHandler(w http.ResponseWriter, r *http.Request) {
 	c := rtpconn.NewWhipClient(g, id, token)
 
 	_, err = group.AddClient(g.Name(), c, creds)
-	if err == group.ErrNotAuthorised ||
-		err == group.ErrAnonymousNotAuthorised {
-		http.Error(w, "Authentication failed", http.StatusUnauthorized)
-		return
-	} else if err != nil {
+	if err != nil {
 		log.Printf("WHIP: %v", err)
 		httpError(w, err)
 		return