Return base AP url in unauthorized response from protected resources

This is a temporary change in response to this issue: https://github.com/ebu/cpa-spec/issues/10.