Throwing UnauthorizedException from CrsUserService (instead of more generic WebApplicationException)