I have a set of content in my web app that should only be visible if you are logged in. They have not public equivalent, should never be crawled, or otherwise known outside of logged in users of specific security levels. I come from the network security world so my first instinct is to "cloak the port" to steal a Steve Gibson line, return a 404 indicating there is nothing there, nor should you expect anything to be there. In the custom 404 page I may include some text advising you to log in if you are not already.
Is this bad practice? Do I gain anything from using the 403 and hanging a sign on my tools that "There is something here, dare you access it".
Edit: Also, I am not using .htaccess to manage folder level permissions. I am using session tracking and Oath to manage logins, so the browser is never used to ask for a login, a web form is. Each script compares against a permission list associated with the currently logged in user. So I should be using 403 not a 401 error.