Respond with 401 for request non-HTML requests

@Houdini can you take at the solution? Is it missing something important?

Responding with empty body and just 401 status is pretty lame. It's a catch-all so neither plain text "Failed second factor auth" nor JSON "{message: "Failed second factor auth"} seems appropriate. I think that's ok because easily override handle_failed_second in your ApplicationController to fit your needs.