title: Return error on invalid or expired token
body: <p>I'm trying to implement OAuth Bearer Authentication with Owin. When an invalid or expired token is passed, the default implementation is to log this as a warning and just don't set an Identity. I however would like to reject the whole request with an error in this case. But how would I do this?</p>
  
  <p>After digging through the code I found out that in <code>OAuthBearerAuthenticationHandler</code> it will parse the token using a fallback mechanism when the provided <code>AuthenticationTokenProvider</code> did not parse any ticket (like the default implementation). This handler will log a warning when the token could not be parsed to any ticket or when it expired.</p>
  
  <p>But I can't find any place to plug in my own logic to what happens when the token is invalid or expired. I could theoretically check this on my own in the <code>AuthenticationTokenProvider</code>, but then I would have to reimplement the logic (= copy it over) for creating and reading the token. Also this seems just out of place, as this class seems to be only responsible for creating and parsing tokens. I also don't see a way to plug in my own implementation of the <code>OAuthBearerAuthenticationHandler</code> in the <code>OAuthBearerAuthenticationMiddleware</code>.</p>
  
  <p>Apparently my best and cleanest shot would be to reimplement the whole middleware, but this also seems very overkill. </p>
  
  <p>What do I overlook? How would I go on about this the best?</p>
  
  <p>edit:</p>
  
  <p>For clarification. I know by not setting an identity the request will be rejected with 401 Unauthorized later in the Web API. But I personally see this as really bad style, silently swallowing an erroneous access token without any notification. This way you don't get to know that your token is crap, you just get to know you're not authorized.</p>