Api gatekeepers

* Gatekeepers no longer forward if this is an api request, as this causes the response code to be lost
* Removes http 401 (which is invalid in this context), and replaces it with 403