Return 401 Unauthorized if unauthorized
Return 401 Unauthorized if unauthorized

Should be no user-visible behaviour here, since we're actually doing a
bit of double processing of our logins. Nevertheless, if a request
somehow gets through to the second layer without auth, they'll get a 401
rather than a 500.

Also makes the API of these handlers more obvious, since they're now
functions that expect a user id.

jml/hazard,jml/hazard