Use 401 status code for some OAuth 2 errors