change failures to 4xx codes

[kroist]

we return replybase.failure(msg) which returns 200 codes

should be 4xx, for example:

• 401 unauthorized
• 404 Not Found