[Security] Return 401 when using use_forward for form authentication

Currently, unauthenticated requests gets handled as exceptions
and forwarded to the FormAuthenticationEntryPoint::start. When
using use_forward=true, the subRequest should set an X-Status-Code
header with the value 403 to avoid requests being logged as 500
errors.