Mattdrayer/api authn 401to403

@martynjames, as discussed I've changed the system's response for invalid authentication -- when a call to authenticate() yields None -- from 401 Unauthorized to 403 Forbidden.  @ziafazal, FYI