Return 401 or 403 on auth failure