Return 401 when using xml and json responses

When the user is unauthorized, the default response is to redirect
to an unauthorized url (the login path). This doesn't make sense
when using an xml or json response (e.g. for an api). Instead, return
a 401 Unauthorized status like devise does.