Set the status before of setting the response body

The 401 status should be set first because setting the response body in
a live controller also closes the response to further changes.

Fixes #14229.