Maybe related. I was always confused with the authorization header and 401 status code (unauthorized).

I've only ever seen authorization header containing credentials (i.e. authentication, who you are) instead of authorization (what you can do).

Also everyone returns 401 when unauthorized (i.e. can't do a thing), instead of 403 (forbidden, i.e. can't do the thing). When 401 should probably be "unauthenticated" (we don't know who you are, so we can't authorize you).

Always messes with my head a bit.