Keep looking. The original implementation for this didn't raise an exception, it called out to the self.unauthorized call. Maybe the answer is to make this change and then raise the exception instead of calling the http methods.