RolesAllowedDynamicFeature can return 401 or 403 errors.

Currently, the RolesAllowedRequestFilter will always return HTTP 403 Forbidden. This is accurate in all cases where the security context is aware of the principal (securityContext.getUserPrincipal() is not null), however it is not strictly accurate in the case where a user has not been authenticated. In that case, returning HTTP 401 Unauthorized is more accurate, as the user has not provided the correct credentials.

The following code should suffice, if inserted before the role check loop.

```
if(requestContext.getSecurityContext().getUserPrincipal() == null && rolesAllowed.length > 0) {
throw new NotAuthorizedException();
}
```
#### Affected Versions
[2.16]