Return the correct HTTP status

We should return 401 Unauthorized rather than 403 Forbidden.

Fixes #70590126.