Use 401 for unauthorized ajax calls.