Shouldn't we return 403 Forbidden instead of 401 Unauthorized if the user isn't authenticated to access the resource? This because, 401 is fixed by reauthentication, but 403 won't be fixed by that.