make sure we return status also for errors

In testing some clamshell changes and leaving the app running overnight I noticed that when the app is not logged in we are returning a message but not status code. I am relying on a 401 status in this situation to take the user back to the login screen.

@nicolashery or @cheddar could you have a look at this please