added: 401-error handling and login-required-page
fixed: a little bug in app.js