Soft-logout should be the default on 401 errors.

Currently soft-logout (https://matrix.org/docs/spec/client_server/r0.6.1#soft-logout) defaults to `false` on 401 errors, for backwards compatibility. This means that if someone accidentally puts their matrix CS API behind HTTP auth (as presumably per https://news.ycombinator.com/item?id=27907696), then clients may see the 401 and hard logout, destroying local user data. Instead, I suggest they should only explicitly hard logout if `soft-logout: false`. (Alternatively, `hard-logout: true`).

Start with the Matrix Client-Server API soft-logout section linked in the issue and review how 401 responses define logout behavior. Consider the backwards-compatibility concern and the two proposed alternatives. Done means the specification resolves and documents the default behavior for soft and hard logout.

Written by the indexing model from the issue text.