Reply 401 on unauth access to secure urls
Reply 401 on unauth access to secure urls

The default configuration is to redirected to the login url, but since
we're going to be calling from a SPA we won't be displaying the page
that the redirect points to. By returning a 401 we can catch that, mark
the user as logged out and return them to the login screen.

danmidwood/expensapp,danmidwood/expensapp