Return 401 headers when trying to access a restricted api call

Return a 401 header to the browser / client when they try to access a restricted without the correct auth headers. Makes it easier to test the api in a browser, and properly informs the client of the result of the call.