So, in this particular case, we don't return a 401; we simply don't return the data (so the exploitabilityScore key doesn't exist in the struct dictionary).

Below we test that when a user is logged in, it shows up. If you'd like, I can rework this so that we test the logged in condition first, and the logged out condition second. That might be more readable.