return 401 error for unauthorised pages

At the moment we return an html 404 page which is both inaccurate and unhelpful when using the API so now we return a 401 error and using content detection we work out the appropriate formate to return the error in.

Fixes #611
This could be simplified to `req.logIn(user, next)` to avoid the extra layer of nesting. (And indented by two spaces for consistency :wink: )