Api authorisation

Closes #63 
Would status 403 not be better? So it [looks](http://en.wikipedia.org/wiki/List_of_HTTP_status_codes) to me like 401 is more for cases where authentication is still required, whereas 403 is the more for the "you do not have permission, go away" case.