There are cases where you can get to resources anonymously and others that cause 403 which should be manifested as 401. Modify the auth logic to throw an unauthorized if a 403 is returned and no token was provided for authentication