gRegorStill don't fully understand it, but the host said Apache was trying to serve the ErrorDocument under the same rules, so it was 401 -> sub-request -> 404 fallback. One solution they offered, which worked, was to have an inline ErrorDocument: `ErrorDocument 401 "Authorization Required"`
