[1297] Use 401 rather than 403 so it shows a login form