Reorder respond_to formats in deny_access

Only API requests should return a 401. Previously, a request for any
type that wasn't HTML would return a 401. This isn't desired in many
cases (for instance, PDF).

Ultimately this may be best as a configurable block, though this is a more sane default.