401 — credentials are missing, expired, or rejected.
HTTP status, or null for failures that are not transport errors.