Use sendError instead of setStatus to send the 401 code. This is per section 9.9.2 of the spec. It doesn't seem to cause any problems in my testing, and it also allows (the mostly useless) custom 401 page.