I see your point of not revealing user content, though to conform to Monban I'd expect the failure app would make the decision of the unauthorized response code. The reason it comes back with a 401 at the moment is because the Monban default failure app is configured that way: https://github.com/halogenandtoast/monban/blob/master/lib/monban/configuration.rb#L62

This is also checked here: https://github.com/halogenandtoast/monban/blob/master/spec/features/visitor/visitor_is_unauthorized_spec.rb

If someone wants unauthorized access to result in a 404, isn't that where the configuration should happen instead?