API-type requests should error on auth failure

This should be easier for clients (and our own JS) to code for than
redirects. Related to #783.