There is no exception thrown when authentication fails, 'throw' statement is used in warden, instead of raise. And it's caught outside of this method, making sure 401 is returned to the client.