ZegnatThe HTTP code is also an iffy one. I feel like that was brought up a couple of times in the autoauth discussions. You may want to both signal with a header that your site supports logging in to see more things, while also giving 404 responses because URLs might leak informatoin
