Wired up the logout link
Got an error message showing on incorrect credentials. Added a check for the X-Requested-With header in authorization function. If present, we return a 403 instead of a 401, which prevents the browser from popping its own login box. This header is always added by jQuery, so it shouldn't affect other clients