Serve a 401, not a 403, where appropriate