return 401 error for unauthorised pages

At the moment we return an html 404 page which is both inaccurate and unhelpful when using the API so now we return a 401 error and using content detection we work out the appropriate formate to return the error in.

Fixes #661