Because that's what the API currently returns. After looking up the distinction between `401` and `403`, it sounds like it should probably be a `403` though.