how about `status: :unauthorized` instead of 401. Easier to understand what that means. Also, do you even need `nothing: true` if you do that?