Return "unauthorized" for HTTP requests

`instance_request` normally sends users to the login page. For the API
we really just want to return a 401