fix: return 401 on unauthorized non-browser requests

closes #115

Pipfile

@@ -19,6 +19,7 @@ pyyaml = ">=4.2b1"
 [dev-packages]
 chartpress = "*"
 pylint = "*"
+yapf = "*"
 
 [requires]
 

src/notebooks_service.py

@@ -142,6 +142,16 @@ def decorated(*args, **kwargs):
         if user:
             return f(user, *args, **kwargs)
         else:
+            # if the request is not coming from a browser, return 401
+            if request.is_xhr or request.environ['HTTP_ACCEPT'
+                                                 ] == 'application/json':
+                app.logger.info(
+                    'Unauthorized non-browser request - returning 401.'
+                )
+                response = jsonify(error='An authorization token is required.'))
+                response.status_code = 401
+                return response
+
             # redirect to login url on failed auth
             state = auth.generate_state(next_url=request.path)
             app.logger.debug(