Apache module returns 401, should be 403

If I setup a protected section of a site using CrowdAllowedGroups users who are not a member of that group get kicked out with 401, despite the fact they are authenticated. This should really be 403 (Forbidden).