principal: raise 401 on authorization failure

Instead of giving 500 Internal Server Error. A template is shown to the user about authorization failure.

The template however is a bit "funky":

![Funk!](http://dl.dropbox.com/u/19162117/Selection_007.png)