@iNecas Why do we want not providing credentials to be a 500 ISE? Shouldn't this instead be a 403?