Denied API requests respond with proper status code

When an API (js, xml) request is denied, clearance should respond with
the proper HTTP status code rather than redirecting to sign_in or
sign_up.