wrong HTTP error status code

[kaievns]

you're throwing 403s instead of 401s

403 - means permission denied. which means a user authentication is valid, they just try to access something above their level, like admin features and such.

401 - means authentication failed or was not issued

https://en.wikipedia.org/wiki/List_of_HTTP_status_codes