Differentiate browsers from REST clients

And use this information to determine the response to access without a
login.

@IanConnolly - what do you think?  I was getting 302 responses for unauthenticated requests from curl, which didn't seem right.