AID-599: Redirect user back to URL when doing a POST

@helgeblod: 400 is a bit too generic, I think, and 403 Forbidden is also bad because of the it has in the specification:

> Unlike a 401 Unauthorized response, authenticating will make no difference.

Source: http://httpstatus.es/403

This endpoint is used for when a user is *trying* to auth, so authenticating will make a difference.

Thus, I think 401 Unauthorized makes most sense.