title: Should 401 Unauthorized or 403 Forbidden be used here?
body: <p>I've read this <a href="https://stackoverflow.com/questions/3297048/403-forbidden-vs-401-unauthorized-http-responses">similar question</a> but it doesn't quite satisfy me. </p>
  
  <p>I have two use cases. </p>
  
  <ol>
  <li>An anonymous(unauthenticated) user tries to access a protected(authorized only) resource</li>
  <li>An authenticated user tries to access a resource which he is not entitled to access(ie, doesn't belong to a group)</li>
  </ol>
  
  <p>For these two cases, which error code should be returned? I'm guessing 401 for the first and 403 for the second. But for 401, a WWW-Authenticate header must be included in the response. I'm not wanting to use the basic HTTP authentication, opting instead for the more conventional form based approach. (ie, user submits a form from Login.aspx or whatever). </p>
  
  <p>So which one should I use?</p>