Fix: expect 401 instead of 403