Use "Unauthorized" instead of "not authorized" to match the expected response. Add tests for basic auth error cases.
lovasoa