Respond with 403 if Authorization header is not present

:koala: :bug: 

This PR fixes an issue where the API would return 200 with an empty response body if there was no Authorization header in the request.

/cc @jwswj @maximeprades @ebizmarts