`return web.Response(status=web.HTTPUnauthorized.status_code)` doesn't make any sense due to a lack of handle.