GET api.launchpad.net/1.0/ doesn't check OAuth validity

If you request api.launchpad.net/1.0 (which implicitly happens when lplib creates a Launchpad object), using expired OAuth credentials, the request completes anyhow. However, if you request other public objects such as /1.0/debian with an expired token, the request fails. This seems inconsistent and makes coding a client that handles expiry cleanly very slightly harder.

I think Launchpad ought to either:
 - refuse everything with invalid oauth or
 - treat it as being unauthenticated