Add res.unauthorized() mixin

Since HTTP Status Code 401 Unauthorized is actually quite different from 403 Forbidden, I suggest there should be a separate mixin for that.

401 indicates that authentication is needed, while 403 indicates that further authentication has no effect - the resource will still be forbidden.

This PR adds the mixin and related boilerplate views / config.

PS. It also fixes the wrong comment title for res.badRequest().

Note: I closed this PR previously because it did not meet the guidelines for contributing. It should now follow the guidelines.