Fixed #1 Use 401 instead of 403 for unauthorized