No redirection by default (401 UNAUTHORIZED instead)

[theo-lubert]

Ignore redirection by default, using standard 401 HTTP response code. Also a small fix in the doc:

• no argument => all roles have access, only needs authenticated user
• empty array => no access