Set the status before of setting the response body

The 401 status should be set first because setting the response body in
a live controller also closes the response to further changes.

Fixes #14229.
pg guide, minor copy edits
Fix parsed token value with header `Authorization token=`.