Don't return a 401 for GET requests to the login page

It doesn't tell us anything useful so don't do it. Since hypermedia
negotiation isn't yet complete, I'm not counting this as a backward
incompatible change.