Return error code instead of redirect when there's an access problem with a json request. This fixes a crash on login with the iOS client when the user is locked.
Added test for previous commit and correctly handled unauthorized JSON requests for login_required.