The 401 should really be a 403

The user making the request is a real authorized user, but is forbidden
from accessing the specified resource.