Changes

Send HTTP Unauthorized (401) for router metrics URL
We were previously sending Forbidden (403) which doesn't make the
browser prompt for a username and password.  It is better to send
Unauthorized (401) so that they can present credentials using the
browser widget rather than having to jam them in the URL.
Fixes bug 1467257 (https://bugzilla.redhat.com/show_bug.cgi?id=1467257)
 (commit: 47270ca)