Failed group membership check should return 403, not 401

server/http.go

@@ -212,7 +212,7 @@ func (h *Server) handleHomepage(w http.ResponseWriter, req *http.Request, sessio
 			// service, because the 'g' parameter is untrusted at
 			// this stage.
 			if len(groups) == 0 {
-				http.Error(w, "Unauthorized", http.StatusUnauthorized)
+				http.Error(w, "Forbidden", http.StatusForbidden)
 				return
 			}
 		}