Let's return a 401 rather than a *cough* 500 *cough* when a user
accesses one of the URLs needing authentication.