Send proper 401 error and header when user authentication fails.
Check the permission to make sure the user has basic rights.

If the user isn't authenticated, he'll be redirected to the right place