I also replaced the 'access denied' logic in the administration UI with a redirect to 401.