Send 401 Unauthorized instead of 403 Forbidden upon failed app session verification