Error messages refactor

Forked from #2 (closed)

• remove behaviour of any 403/401 to be logged out (locked submissions would answer 403, which is not a logout behaviour). Restrict this action to a ApiErrorCode.AUTH_SESSION_EXPIRED yet to be implemented on backend)
• errors from the backend should be treated on the frontend, or at least expose the error message. Users must know what is happening and what they should change if there's something wrong.