You should return 403 here; If you return 401, I think the browser will prompt you for a username/password...