title: why does flask-security redirect to unauthorized view
body: <p>I'm giving flask-security a go...it has a lot of nice pieces to it. I ran into some quirky behavior though that I don't really understand. From the code I looked at it looks very intentional that the code works the way it does, but I can't understand the rationale.</p>
  
  <p>If you protect a view using <code>@auth_token_required</code> and the criteria is not met a 401 is returned. Makes perfect sense.</p>
  
  <p>However, if you protect a view using <code>@roles_required</code> and the criteria is not met, the server redirects (302) to an unauthorized view.</p>
  
  <p>This makes no sense to me why they both would not behave consistently. Indeed in both cases I want and expect a 401.</p>
  
  <p>Can anyone explain the reasoning and why I might want this? Or can someone explain the best way to customize the @roles_required behavior?</p>
  
  <p>Thanks!</p>