[SalesForce] 401 Unauthorized error when calling rest service in salesforce from external tool

In order to test the callout you should implement a HttpCalloutMock (official doc) to emulate the remote service, then set it in your test class

Test.setMock(HttpCalloutMock.class, new YourHttpCalloutMockImpl());

Regarding to read the XML response, I recommend you to use de Dom class (official doc)

Sample of how to read the response:

        HttpResponse res = h.send(req);
        Dom.Document doc = res.getBodyDocument();

        //Retrieve the root element for this document.
        Dom.XMLNode address = doc.getRootElement();

        String name = address.getChildElement('name', null).getText();
        String state = address.getChildElement('state', null).getText();
        // print out specific elements
        System.debug('Name: ' + name);
        System.debug('State: ' + state);

        // Alternatively, loop through the child elements.
        // This prints out all the elements of the address
        for(Dom.XMLNode child : address.getChildElements()) {
           System.debug(child.getText());
        }

In the case of a Force.com Site the Apex class must be enabled on the special Guest profile associated with the site.

Setup > Develop > Sites > [your site label] > Public Access Settings > Enabled Apex Classes