Fix wrong status code
Fix wrong status code

Authorization failure needs to return 403 forbidden. Returning 401 unauthenticated explicitly requests the client to retry with a new authentication attempt. Returning 401 instead of forbidden will most likely result in an infinite loop that the browser hopefully halts with "too many redirects" otherwise you just mini-dos'd yourself for as long as they keep the tab open.
abergs/OwinFriendlyExceptions