Make sure API responds with 401 when invalid authentication info is provided

Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/38438

When the tests go green, I'll split the commit up to make it easier to review.