Throw a 401 error when a user doesn't authenticate rather than a 400.