Return a 401 for unauthenticated and 403 for unauthorized