When the session expires for a request from CODAP, respond with a 401

Also, by putting Rack::Cors before Warden, the 401 response will still
have valid CORS headers.

[#83967106]