There seems to be a lot of confusion about the correct http status code to return if the user tries to access a page which requires the user to login.
So basically what
I believe 401 is the correct status code to return from failed authorization. Reference RFC 2616 section-14.8 It reads "A user agent that wishes to authenticate itself with a server-- usually, but not necessarily, after receiving a 401 response"