Improve RPC authentication failure responses.

This commit improves how the legacy RPC server responds to authentication
failures so things like web browsers can react better.  The following
changes have been made:

First, authentication failures were only printing the 401 error response
in the body instead of setting the http status code.  This means the
response had a 200 OK header with a body of 401 Unauthorized.  Therefore
the client would think everything was ok, but see the response as
malformed JSON.

Second, the spec for 401 Unauthorized responses state they must include a
WWW-Authenticate header to instruct the client how to authenticate.
Without this, browsers won't prompt the user for credentials.