Change annotation create response to 201

With the URL to read the annotation in a Location header
Send 403 when authenticated but not authorized
Merge pull request #96 from seanh/63-improve-response-codes-and-headers

#63 improve response codes and headers