Improve logging for exchange failures

server/http.go

@@ -290,8 +290,13 @@ func (h *Server) handleExchange(w http.ResponseWriter, req *http.Request) {
 	reqGroups := strings.Split(req.FormValue("new_groups"), ",")
 
 	token, err := h.loginService.Exchange(curToken, curService, curNonce, newService, newNonce, reqGroups)
-	if err != nil {
-		log.Printf("exchange error: %v", err)
+	switch {
+	case err == ErrUnauthorized:
+		log.Printf("unauthorized exchange request (%s -> %s)", curService, newService)
+		http.Error(w, "Forbidden", http.StatusForbidden)
+		return
+	case err != nil:
+		log.Printf("exchange error (%s -> %s): %v", curService, newService, err)
 		http.Error(w, err.Error(), http.StatusBadRequest)
 		return
 	}