[API]: Give a 401 when we have no tenant ID

This shouldn't happen in Keystone because Keystone will catch the problem
before we get this far, but it is good to catch this case.

Also if we have disabled keystone for testing it is good to give a 401
instead of a 500

Change-Id: I70c2009a5868be23e1811a837c00ddb901bbdbfc