I think that is one of the biggest mistakes github did. I don't care what the spec says, you should always default to 401, so that requests can be retried with

I think that is one of the biggest mistakes github did. I don't care what the spec says, you should always default to 401, so that requests can be retried with auth. Then after getting through the 401, you should fire the 404 or 200 (as the case may be).