401 status code instead of redirect when securing API

I added an option to send 401 (Unauthorized) instead of redirecting to '/login' by default. This should be useful for securing APIs when accessed by client-side script.