Mattdrayer/api authn 401to403

@martynjames, as discussed I've changed the system's response for invalid authentication -- when a call to authenticate() yields None -- from 401 Unauthorized to 403 Forbidden.  @ziafazal, FYI
Doesn't seem to be in the right place... I have a user 'admin_user' configured with password 'abc'. When the user is marked active (is_active == 1) then I get the following behavior with a bad password:

*REQUEST:*
    POST /api/sessions/ HTTP/1.1
    Accept-Encoding: identity
    X-Edx-Api-Key: marty_api_key
    Host: localhost:56480
    Content-Length: 43
    User-Agent: Python-urllib/2.7
    Connection: close
    Content-Type: application/json

    {"username": "admin_user", "password": "1"}

*RESPONSE:*
    HTTP/1.0 403 FORBIDDEN
    Date: Fri, 13 Jun 2014 15:37:08 GMT
    Server: WSGIServer/0.1 Python/2.7.3
    Vary: Accept, Accept-Language, Cookie
    X-Frame-Options: ALLOW
    Content-Type: application/json; charset=utf-8
    Content-Language: en
    Allow: POST, OPTIONS

    {}

which was previously a 401.

Conversely, the path that I expect to get a 403 on - is_active == 0; still gets a 401 error:

*REQUEST:*
    POST /api/sessions/ HTTP/1.1
    Accept-Encoding: identity
    X-Edx-Api-Key: marty_api_key
    Host: localhost:56480
    Content-Length: 45
    User-Agent: Python-urllib/2.7
    Connection: close
    Content-Type: application/json

    {"username": "admin_user", "password": "abc"}

*RESPONSE:*
    HTTP/1.0 401 UNAUTHORIZED
    Date: Fri, 13 Jun 2014 15:40:15 GMT
    Server: WSGIServer/0.1 Python/2.7.3
    Vary: Accept, Accept-Language, Cookie
    X-Frame-Options: ALLOW
    Content-Type: application/json; charset=utf-8
    Content-Language: en
    Allow: POST, OPTIONS

    {}

For reference, here's the happy path:

*REQUEST:*
    POST /api/sessions/ HTTP/1.1
    Accept-Encoding: identity
    X-Edx-Api-Key: marty_api_key
    Host: localhost:56480
    User-Agent: Python-urllib/2.7
    Connection: close
    Content-Type: application/json
    Content-Length: 49

    {
      "username": "admin_user",
      "password": "abc"
    }

*RESPONSE:*
    HTTP/1.0 201 CREATED
    Date: Fri, 13 Jun 2014 15:38:32 GMT
    Server: WSGIServer/0.1 Python/2.7.3
    Vary: Accept, Accept-Language, Cookie
    X-Frame-Options: ALLOW
    Content-Type: application/json; charset=utf-8
    Content-Language: en
    Allow: POST, OPTIONS
    Set-Cookie: sessionid=369d7feaa8e95a7ba915065bcb354959; expires=Fri, 27-Jun-2014 15:38:32 GMT; httponly; Max-Age=1209600; Path=/

    {"token": "369d7feaa8e95a7ba915065bcb354959", "expires": 1209600, "user": {"id": 1, "email": "admin_user@mckinseyacademy.com", "username": "admin_user", "first_name": "Uber", "last_name": "Admin"}, "uri": "http://localhost:56480/api/sessions//369d7feaa8e95a7ba915065bcb354959"}