Reorder respond_to formats in deny_access

Only API requests should return a 401. Previously, a request for any
type that wasn't HTML would return a 401. This isn't desired in many
cases (for instance, PDF).
Update Code Climate badge
Set remember cookie as HTTP only for security

Cookies should be marked as HttpOnly for added security, otherwise
persisted XSS could expose the cookie to a 3rd party. SSL is definitely
a deterrent, but wouldn't solve this.
Remove user-controlled return_to parameter

Despite steps taken in 52ebe7ecc5bf0ddcdf3ca0dc07e0160bec45767d, it is
possible for an attacker to construct a retrun_to parameter that would
redirect the user off-site. I can provide the details via email or in
campfire.

The session[:return_to] value does not seem to be similarly vulnerable.

The params[:return_to] parameter isn't actually used in the default
templates. I've seen reports that it is used to support login forms that
are present on every page. Users that need this functionality should set
`session[:return_to]` in a `before_filter` instead.