returning 401 for unauthorized API calls while redirecting to /login for unauthorized page access

TODO

@@ -2,3 +2,6 @@
 - conflict detection
   - note title and content changes are not in audit_log table
 - deleting cloned nodes ends with 500 (probably only on folders)
+- what links here
+- recent changes - link to note should lead to the revision
+- db upgrade / migration

src/app.py

@@ -101,6 +101,13 @@ def load_user(user_id):
     else:
         return None
 
+@login_manager.unauthorized_handler
+def unauthorized_handler():
+    if request.path.startswith('/api'):
+        return 'Unauthorized', 401
+    else:
+        return redirect('/login')
+
 if __name__ == "__main__":
     ssl_context = None