Mount BadAuthentication into the main sinatra app.

This way calls to /unauthenticated won't show a "Not Found".

I tried to run the specs but it's in one way or another. Advice on running them are welcome.

/cc @atmos