Return 401 wherever you'd return a 404. Prevent discovery of user hashes.