Make the firewall's 401 and 403 handling more generic

Now it calls a callback for each, rather than trying to render a
template or return json. lets you set things in the response like the
www-authenticate header, if you want.
Bump version