Reply 401 on unauth access to secure urls

The default configuration is to redirected to the login url, but since
we're going to be calling from a SPA we won't be displaying the page
that the redirect points to. By returning a 401 we can catch that, mark
the user as logged out and return them to the login screen.
Add expense creation service

This adds a route at POST /expense that accepts an expense
representation and creates it in the database against the current signed
in user.

A new database table `expense` has been created along with a companion
Clojure namespace at `expensapp.expenses` containing the queries that
will be used.