Based on configuration, instead of redirect to login, HTTP.UNAUTHORIZED is answered

This is better suited for REST-APIs