Neither 'BadRequest' (as expected in the unit test) nor 'Unauthorized' (as expected in the API tests) seem correct here. We're no returning 'Forbidden' when an unprivileged users issues a GetUsers request that it is not allowed to perform.