fix: differentiate between missing sessions and internal server errors

[osbornk]

Our consumer of the whoami call caches both authorized and unauthorized responses from Kratos. If a session is unauthorized, we should not ping Kratos again for the duration of the cache. However, if Kratos itself had a problem, such as a database error, these responses were coming back as 401s as well. And now we have this potentially false unauthorized response in our cache.

Instead, a 500 is the correct response for a Kratos failure. That way our cache can choose to do nothing with this response and not end up with a poisoned cache.

With this change, an invalid session continued to produce a 401. Valid sessions continue to produce a 200. A Kratos failure, such as a database problem, produces a 500.

BREAKING CHANGES: A Kratos failures for `whoami` currently returns a 401. It will now return a 500.

Checklist

• I have read the contributing guidelines.
• I have referenced an issue containing the design document if my change
  introduces a new feature.
• I am following the
  contributing code guidelines.
• I have read the security policy.
• I confirm that this pull request does not address a security
  vulnerability. If this pull request addresses a security vulnerability, I
  confirm that I got the approval (please contact
  [email protected]) from the maintainers to push
  the changes.
• I have added tests that prove my fix is effective or that my feature
  works.
• I have added or changed the documentation.

Further Comments