Return a 401 message with an JSON encoded body, if no authentication header is passed for an API request.

Also for browser requests, a flash message is shown in that case, prompting the user to authenticate.

This follows a suggestion from issue #494

config/packages/security.yaml

@@ -19,7 +19,7 @@ security:
             provider: app_user_provider
             lazy: true
             user_checker: App\Security\UserChecker
-            entry_point: form_login
+            entry_point: App\Security\AuthenticationEntryPoint
 
             # Enable user impersonation
             switch_user: { role: CAN_SWITCH_USER }