Improve authenticate consistency, use 401 code