Think a 403 should throw a ForbiddenException. There is a difference between 401 and 403 which the client should respect.