It should be better if the response message is managed by the frontend.
We should have only:
render status: :unauthorized