Return reject promise in securityInterceptor

As per https://github.com/angular/angular.js/issues/2609, $http calls
always processed their success callback because the interceptor
stripped out the reject promise.