[esafak]

> The team constantly bikesheds over correct status codes and at least a few are used contrary to the HTTP spec

401 Unauthorized. When the user is unauthenticated.

403 Forbidden. When the user is unauthorized.