I still lean towards treating 'bad-user-or-pass' as fatal, but I won't hold up the review on account of that. I'm pretty sure a 403 'not-authorized' is the right response for this case, and I hope it's pretty much universal.