Use 401 instead of 403 where appropriate

[mattbk]

#4040 (comment)

401 = not logged in
403 = already logged in but still not allowed

Then why do I get 403 when not logged in, for pages like this?

#4040 (comment)

Because we're doing it wrong? :)
Unless we're not, but I think we are ...
https://httpstatuses.com/401
https://httpstatuses.com/403

Relates to #4189, which is due to #4040.

[mattbk]

Based on some discussion at http://stackoverflow.com/questions/3297048/403-forbidden-vs-401-unauthorized-http-responses, it looks like 401 should be returned if you are not logged in and are trying to access a page you need to be logged in to see, regardless of whether you have privileges to see it or not as an authenticated user. This is what @whit537 notes at the beginning of this issue.

[nobodxbodon]

Please reopen if there's new finding which is not covered by #4197