Because exception are caught inside security authenticator and hhandled. So, this failure handling makes sure it throws something 401 rather 500