Very close, unauthenticated fails, but so does authenticated