Nothing In the spec states otherwise, and infrequently you can't use a 401 in that scenario since returning a 401 is simply legal for those who consist of a WWW-Authenticate header. Early hackers were being thinking about how they might investigate, improve, and take a look at the limits of http://pigpgs.com