Which HTTP status code is the correct response for a request with an incorrect password applied to a REST API session?