A failed auth attempt should always return HTTP code 401.

As far as I've tried (password only), the code returned is always 200.