It's the entire metaphor that's broken, so the fact that you can vaguely map "locked" to a properly functioning auth system and "unlocked" to an unintentional 2

It's the entire metaphor that's broken, so the fact that you can vaguely map "locked" to a properly functioning auth system and "unlocked" to an unintentional 200 response is irrelevant. My neighborhood is not the internet. There is no written, unambigous protocol which my door implements in order to accept or reject guests. In fact, my door isn't programmed to issue responses of any kind; a human or even an answering system might do that, and yes, they might plausibly grant access. More important is the reverse: the internet is not your neighborhood, and mapping the laws (both legal and social) on a 1-to-1 basis in an effort to recreate the norms of your neighborhood on a worldwide telecommunications system is really inane. I can't for a second make sense of it, much less what lessons it provides us for the proper legal and moral framework to accompany HTTP.