I thought that incorrect/inaccessible application ID should generate 403, while invalid credentials would generate 401. @dornatsky can you comment?