Repository: vert-x3/vertx-web
Issue: FormLoginHandlerImpl should return status 401 on failed authentication

### Version

* vert.x core: 3.8.4
* vert.x web: 3.8.4

### Context

I was using the FormLoginHandler to perform simple form-based login. The default implementation sets the status code to 403 ("Forbidden") which to me indicates that the user is not **allowed** to login. I think 401 ("Unauthorized") is more appropriate since it "[indicates that the request has not been applied because it lacks valid authentication credentials for the target resource](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/401)"

Also see
https://stackoverflow.com/questions/3297048/403-forbidden-vs-401-unauthorized-http-responses

### Do you have a reproducer?

Just read the code at:
https://github.com/vert-x3/vertx-web/blob/4c2ab04649c0ed306099abac1346f5fedea8c53b/vertx-web/src/main/java/io/vertx/ext/web/handler/impl/FormLoginHandlerImpl.java#L125

### Steps to reproduce

1. Add FormLoginHandler to route
2. Submit wrong credentials via html form
3. observe


Changed files:
vertx-web/src/test/java/io/vertx/ext/web/handler/RedirectAuthHandlerTest.java, vertx-web/src/main/java/io/vertx/ext/web/handler/impl/FormLoginHandlerImpl.java

diff --git a/vertx-web/src/main/java/io/vertx/ext/web/handler/impl/FormLoginHandlerImpl.java b/vertx-web/src/main/java/io/vertx/ext/web/handler/impl/FormLoginHandlerImpl.java
index 0fe34f8d6..71ed6f810 100644
--- a/vertx-web/src/main/java/io/vertx/ext/web/handler/impl/FormLoginHandlerImpl.java
+++ b/vertx-web/src/main/java/io/vertx/ext/web/handler/impl/FormLoginHandlerImpl.java
@@ -81,7 +81,7 @@ public class FormLoginHandlerImpl implements FormLoginHandler {
   public void handle(RoutingContext context) {
     HttpServerRequest req = context.request();
     if (req.method() != HttpMethod.POST) {
-      context.fail(405); // Must be a POST
+      context.fail(new HttpStatusException(405)); // Must be a POST
     } else {
       if (!req.isExpectMultipart()) {
         throw new IllegalStateException("HttpServerRequest should have setExpectMultipart set to true, but it is currently set to false.");
@@ -91,7 +91,7 @@ public class FormLoginHandlerImpl implements FormLoginHandler {
       String password = params.get(passwordParam);
       if (username == null || password == null) {
         log.warn("No username or password provided in form - did you forget to include a BodyHandler?");
-        context.fail(400);
+        context.fail(new HttpStatusException(400));
       } else {
         Session session = context.session();
         JsonObject authInfo = new JsonObject().put("username", username).put("password", password);
@@ -122,7 +122,7 @@ public class FormLoginHandlerImpl implements FormLoginHandler {
               req.response().end(DEFAULT_DIRECT_LOGGED_IN_OK_PAGE);
             }
           } else {
-            context.fail(403);  // Failed login
+            context.fail(new HttpStatusException(401));  // Failed login
           }
         });
       }
diff --git a/vertx-web/src/test/java/io/vertx/ext/web/handler/RedirectAuthHandlerTest.java b/vertx-web/src/test/java/io/vertx/ext/web/handler/RedirectAuthHandlerTest.java
index a0bdae237..1612a10cc 100644
--- a/vertx-web/src/test/java/io/vertx/ext/web/handler/RedirectAuthHandlerTest.java
+++ b/vertx-web/src/test/java/io/vertx/ext/web/handler/RedirectAuthHandlerTest.java
@@ -275,7 +275,7 @@ public class RedirectAuthHandlerTest extends AuthHandlerTestBase {
       req.putHeader("cookie", sessionCookie.get());
       req.write(buffer);
     }, resp -> {
-    }, 403, "Forbidden", null);
+    }, 401, "Unauthorized", null);
     testRequest(HttpMethod.GET, "/protected/somepage", req -> req.putHeader("cookie", sessionCookie.get()), resp -> {
       String location = resp.headers().get("location");
       assertNotNull(location);