4xx errors from here should go to the client so he can be prompted for a password. so should 3xx redirects to a login form.