API requests interact poorly with require_admin

The `require_admin` decorator forwards users to the login page.  However, this doesn't make sense for unauthorized API requests.  This change makes API requests return a 403 (unauthorized).

In addition, the video update page has no behavior changes if the check_download_status fails.  One scenario where this happens is when the login expires, and the API requests fail.  This used to cause the messages cache to fill with errors.  This change catches such API errors and either stops checking the status, or or refreshes the page (if login expired).