Unauthenticated requests send wrong HTTP status code

[klada]

Starting with version 2.0 the API requires an authentication token. However this is not signaled correctly through a HTTP status code.

Scripts which are accessing the API without a valid token are still getting a HTTP 200 status code (which means OK). However the correct status code would be 403 or 401.

Since the API continues to reply with 200 existing scripts might break without the user noticing as it is a common pattern to check for status codes when processing API requests.

[jens-maus]

essentially a duplicate of #38