403 on a private page when logged out should be 401

[MarkTraceur]

https://en.wikipedia.org/wiki/List_of_HTTP_status_codes#4xx_Client_Error

"401 Unauthorized: Similar to 403 Forbidden, but specifically for use when authentication is required and has failed or has not yet been provided."

"403 Forbidden: The request was a valid request, but the server is refusing to respond to it. Unlike a 401 Unauthorized response, authenticating will make no difference."

Obviously me authenticating as myself will let me see my own posts, so 401 is the proper code.

[MarkTraceur]

Notably, 403 seems like the right response when a logged-in user cannot access a post.

[evanp]

Fair enough.

[strugee]

We're releasing 1.0.0 tomorrow and this isn't in it. Pushing to a later release