We don't want 500, that's what I'm saying, except it should be 401 (Unauthorized), instead of 403. The code I've suggested does exactly that.