[web] return 403 for Unauthorized, not 401
401 is reserved to HTTP authentication. Just because it's also called
"unauthorized" doesn't mean it's the same as cubicweb's Unauthorized
exception. Closes #3648809.
usr/lib/PY_VERSION/*-packages/cubicweb/entities/
usr/lib/PY_VERSION/*-packages/cubicweb/ext/
usr/share/cubicweb/cubes/
usr/lib/PY_VERSION/*-packages/cubicweb/*.py