diff --git a/module/obmc/wsgi/apps/rest_dbus.py b/module/obmc/wsgi/apps/rest_dbus.py
index 246396c..fa4037f 100644
--- a/module/obmc/wsgi/apps/rest_dbus.py
+++ b/module/obmc/wsgi/apps/rest_dbus.py
@@ -41,7 +41,7 @@
     ''' Authorization plugin callback that checks
     that the user is logged in. '''
     if session is None:
-        abort(403, 'Login required')
+        abort(401, 'Login required')
 
 
 class UserInGroup:
@@ -479,7 +479,7 @@
             abort(400, self.bad_json_str % (request.json))
 
         if not self.authenticate(*request.parameter_list):
-            return self.bad_passwd_str
+            abort(401, self.bad_passwd_str)
 
         user = request.parameter_list[0]
         session = self.new_session()