Do not send token in reponse unless authenticated

This causes a parsing error in Google Chrome, causing it to
display a 320 instead of a 401.
Update ChangeLog/README to reflect recent changes