If you look a few lines above, it's still using HttpUnauthorized for the `status` filtering with the same admin/reviewer condtion.