Sure I will add a Unit Test for this.
I addressed the 401 and 403 issue in previous comment. 
If the user isn't authenticated it should be 401 and if it is is authenticated but forbidden it should be 403.