Throw 401 when auth fails