If not allowed, No echo, but send a 401

Suggested by Denis Chenu