Unauthorized HTTP Response + tests.

Review: https://reviews.apache.org/r/21324