Emit 403 on unauthorized instead of 401