We have some rules for a subtree of
Locations, which involve
The user is duly challenged to supply login-credentials, which are verified.
However, even when the credentials are correct and the access is denied due to other reasons (such as belonging to a wrong group or coming from an incorrect IP-address), the server's response is always 401 -- instead of 403.
As a result, the browsers keep prompting users to "try again"... Can I tell Apache (2.4) to use 403, if the information supplied in the
Authorization-header checks-out, and it is some other rule, that rejects the request?