Fixes #5068: Redirect user to login on 401 and 403 and fix CSRF header.