title: Pundit is working correctly, but returning a 200 instead of 401 for unauthorized users
body: <p>I have specs like this:</p>
  
  <pre><code>it "should let a user destroy their own picture" do
    expect do
      delete :destroy, { id: p1.id }
      puts "\n\nOK resp\n#{response.status}\n\n\n"
    end.to change { Picture.count }.by(-1)
  end
  
  it "should not let a user delete another user's picture" do
    sign_in(user2)
    expect do
      delete :destroy, { id: p1.id }
      puts "\n\nNOT OK resp\n#{response.status}\n\n\n"
    end.to change { Picture.count }.by(0)
  end
  </code></pre>
  
  <p>The first one correctly returns a <code>302</code> (I redirect after destroy). The second one correctly passes, meaning the user can't destroy, but it returns a <code>200</code> status code, instead of the <code>401</code> as it should return.</p>
  
  <p>In my <code>ApplicationController</code>:</p>
  
  <pre><code>class ApplicationController &lt; ActionController::Base
    include Pundit
    rescue_from Pundit::NotAuthorizedError, with: :user_not_authorized
  
    def user_not_authorized
      render file: "public/401.html", status: :unauthorized
    end
    ...
  end
  </code></pre>
  
  <p>With or without the <code>rescue from</code> line, I still get a <code>200</code>. It seems that while <code>pundit</code> is correctly catching <code>true</code> or <code>false</code> in the <code>authorize(@obj)</code> method and stopping execution, but it's not raising when it gets <code>false</code>.</p>
  
  <p>How can I fix this?</p>