index: Only return 401 when actually unauthorised
index: Only return 401 when actually unauthorised

When the unauthorised flash was added, it changed the index handler to
return 401 for any request not logged in.

This moves the writing of the unauthorised header and the session saving
to inside the block that handles the flash.

jamesog/scan,jamesog/scan,jamesog/scan