Always ensure that we send back JSON

Add a 401 status code to create() to ensure that it turns up in the response.