send 401 directly on failed auth rather than redirect (avoid hsts problems and response redirect always going to http, not https)
Merge remote-tracking branch 'origin/develop' into develop