[401 isn't the right status code here](http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.4.2); it's specifically for requests that require authentication. 403 is probably most appropriate.