Very little within the spec claims otherwise, and often you can't make use of a 401 in that condition for the reason that returning a 401 is barely legal in the event you incorporate a WWW-Authenticate header. I think 403 is ideal fitted to articles that is rarely served. In http://pigpgs.com