The only supported response codes are currently 401, 404, and 500. These are driven by the policy failure type enum. In addition to these, we should allow policies to set whatever they choose. In particular the rate limiting policy could set the http response code to 429.

http://tools.ietf.org/html/rfc6585#section-4