Better response statuses on security exceptions

With my latest patch it returned 412 Precondition Failed on every security. Now a bit more precise responses:

* 401 on Not logged in.
* 403 on Not admin/subadmin
* 412 on Missing XSRF token.

@Raydiation