Ideally, this should happen only when there is an Authentication
failure. Unfortunately, the AuthenticationFilter returns 403 when it
cannot authenticate (Since a 401 requires Server to send
WWW-Authenticate header as well)..