401 versus 403

I am tempted to believe that we sometimes return a 403 where a 401 would be more appropriate.

For example, when an `Authorization` header is sent and no authentication method succeeds, we consider the user as anonymous. It is very likely that a 403 will be returned when trying to create a bucket or something.

What if we return 401 when an `Authorization` header is sent and no authentication succeeds instead of considering the user as anonymous?

Do we have authentication policies that rely on a header that is not `Authorization` ? Do we want to support that?

Start by tracing how an Authorization header is handled when authentication methods fail, then follow the bucket-creation path that may return 403 for an anonymous user. Review whether any authentication policies use non-Authorization headers and establish the expected distinction between 401 and 403 before defining completion criteria.

Written by the indexing model from the issue text.