Return 401 instead of 403 for incorrect login