Add docs for rejections with server responses

[marcoow]

When fixing error handling in the dummy app (see #2138), I realized that the reponse the OAuth2 Password Grant authenticator rejects with when authentication fails, has its body read by the authenticator already which means the body cannot be read again in the error handling code. In order to read the body again, the response has to be cloned first.

While we could do the cloning in the authenticators so that the error handling code would not have to worry about that, that could be wasteful in cases where the error handling code only needs access to e.g. the response headers. While we might still do that in the future, this for now adds some info to the docs.

All of the above also applies to the Devise authenticator which also rejects with the server response when authentication fails.