title: ASP.NET Web API : Correct way to return a 401/unauthorised response
body: <p>I have an MVC webapi site that uses OAuth/token authentication to authenticate requests. All the relevant controllers have the right attributes, and authentication is working ok. </p>
  
  <p>The problem is that not all of the request can be authorised in the scope of an attribute - some authorisation checks have to be performed in code that is called by controller methods - what is the correct way to return a 401 unauthorised response in this case?</p>
  
  <p>I have tried <code>throw new HttpException(401, "Unauthorized access");</code>, but when I do this the response status code is 500 and I get also get a stack trace. Even in our logging DelegatingHandler we can see that the response is 500, not 401. </p>