Break out EAD conversion into a separate class for easier testing.
Add test to ensure valid EAD XML is generated.
Clean up auth code and use 403 over 401 where appropriate.

As [this](http://stackoverflow.com/a/6937030/285374) answer explains,
we should only use 401 UNAUTHORIZED when the user is not logged in and
the situation is temporary. 403 FORBIDDEN should be used when the user
is logged in but doesn't have the correct permission.
Merge branch 'master' into merge_guides