Respond with 401 if not_authenticated redirect is not defined

Change realm for better auth prompt
Respond with 404 if account_locked redirect is not defined
Respond with 404 if bad_login redirect is not defined
Respond with 404 if bad_password redirect is not defined
Removed redundant spec