I used 401, http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html mentions 401 for unauthorized access