Consistently return 401 and 403, as opposed to the schizophrenic version before, which sometimes called next(error) and sometimes res.send(401/403). Bump version.