Return 401 for GET sessions when not logged in
Add resolve property to authenticated routes

resolve returns a promise that is fulfilled only when the user is
logged in. It does this by calling the session status API.
We also need to intercept HTTP 401 errors so that the user is
redirected to the login page when unauthenticated.