We currently raise InvalidToken for 404, though 404 seems to be raised when requesting non-existing methods.
Unauthorized (=401) is the acutal InvalidToken and 403 gives Forbidden. So

• 401 -> Unauthorized
• 403 -> Forbidden
• drop InvalidToken/only use it in Bot._validate_token

I do think we should update that. However those are pretty much breaking changes, so probably only in the next major release …