Return 401 on no session id for rate limiting, update tests