401 if API client is not authenticated

Server should not HTTP-redirect API client to the auth page, error 401 is more suitable.