Return :unauthorized when the user can't create a room, refs #809

Was setting an error flash but returning 200.