Fixed unauthorized redirection

Fixed issue #1 
If you request an api without logged in, you'll get HTTP 401 rather than redirect login page.
Also, login has been changed into api based, you just need to post user name and password to the login api, thus you can login anywhere instead of using a login page, for example, a login dialog.

close issue #1