Return the correct HTTP status

We should return 401 Unauthorized rather than 403 Forbidden.

Fixes #70590126.
Merge pull request #278 from alphagov/authentication-responses

Return the correct HTTP status