title: A distinct HTTP status for not logged in vs. not authorized in a RESTful API
body: <p>So send a few different status headers in my API including <code>404</code>, <code>409</code>, <code>201</code>, <code>302</code> and the like. Now I'm running into issues with <code>401 Unauthorized</code>. I'm currently sending it if a user is not logged in (the entire API is rights managed) or if a user doesn't satisfy the specific access requirements for the particular resource being retrieved/modified.</p>
  
  <p>Now, I also control the frontend client (a jQuery/HTML application), and I'd like to differentiate between the two cases for <code>401</code>. Is there a distinct status I should be using for not logged in? Is the best way to handle it to send body content alongside the header?</p>