not authenticated returns 401, not 403
Merge pull request #525 from yesodweb/not-authenticated-401

not authenticated returns 401, not 403