Return 401 or 403 for auth failures.