Add 401 if Authorization header is not provided
Replace Forbidden by Unauthorized
Add docstring for auth module