Force API controllers to return 401 not authorized if no auth

Changed API Controller base class behaviour to avoid redirect (useless
in the context of a JSON API), and to respond with 401 instead.