AccessExceptions should cause an HTTP 401 response if not logged in

This is a standard practice and the value is that it enables clients
to distinguish an access exception that is simply the result of not
being logged in from something that a logged in user is simply not
allowed to do, so clients can intercept a 401 and prompt the user
to authenticate, and then try again smoothly.