Always serve html responses from auth-request

Simplify js for the not_authorized response.