not authenticated returns 401, not 403