http.UNAUTHORIZED response should be used