always use 401 instead of sometimes 404 and sometimes 401
change test expectations to expect always 401 on access denied
0.3.3