Send back 401 error on upgrade

request already sends back 401 but upgrade does not.
This gives the client a chance to differentiate between auth failure and connection/server fail