fix: return 401 on unauthorized non-browser requests

[rokroskar]

sample response:

curl https://rok.dev.renku.ch/jupyterhub/services/notebooks/user -H "Accept: application/json" --verbose
*   Trying 86.119.25.180...
* TCP_NODELAY set
* Connected to rok.dev.renku.ch (86.119.25.180) port 443 (#0)
* TLS 1.2 connection using TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
* Server certificate: rok.dev.renku.ch
* Server certificate: Let's Encrypt Authority X3
* Server certificate: DST Root CA X3
> GET /jupyterhub/services/notebooks/user HTTP/1.1
> Host: rok.dev.renku.ch
> User-Agent: curl/7.54.0
> Accept: application/json
>
< HTTP/1.1 401 UNAUTHORIZED
< Server: nginx/1.15.8
< Date: Wed, 13 Mar 2019 13:23:51 GMT
< Content-Type: application/json
< Content-Length: 48
< Connection: keep-alive
< Strict-Transport-Security: max-age=15724800; includeSubDomains
<
* Connection #0 to host rok.dev.renku.ch left intact
{"error": "An authorization token is required."

to test, you can simply replace the image of your renku-notebooks deployment with rrrrrok/renku-notebooks:b5b71da

closes #115