Change unauthorized return status to 401 to match return status in part 1

[goodtimeaj]

Changed the return status in server.js to unauthorized 401 from forbidden 403 to match part 2. This could be a source of confusion when continuing on to part 2 with code from part 1: https://github.com/embercasts/authentication-part-2/blob/master/server.js#L64