API GET returns HTTP 401 instead of 404 when requesting non-existent resorces

Using the built-in webserver, API requests for manifests that are not in the repo returns a HTTP 401 error code instead of a 404 even when proper authorization is provided.

Here is an example of a request against my test repo for an existing manifest. The request is authorized and returns the manifest as expected.

$ curl -i -H "Authorization: Basic dGVzdDp0ZW1wdGVtcA==" http://localhost:8080/api/manifests/clients/mac-001.plist
HTTP/1.1 200 OK
Vary: Cookie
X-Frame-Options: SAMEORIGIN
Content-Type: application/json
Set-Cookie:  csrftoken=i75rVHNg3B4EEY2cNVZ8ROyWiiOhG7AF; expires=Sat, 25-Mar-2017 16:52:00 GMT; Max-Age=31449600; Path=/
Set-Cookie:  sessionid=4v1f5wnyw4s0wzuzalv8blvj0mp1btcf; expires=Sat, 09-Apr-2016 16:52:00 GMT; httponly; Max-Age=1209600; Path=/
Transfer-Encoding: chunked
Date: Sat, 26 Mar 2016 16:52:00 GMT
Server: localhost

{"managed_installs": [], "catalogs": ["production"], "managed_updates": [], "included_manifests": ["roles/foo.plist"], "optional_installs": [], "managed_uninstalls": [], "serial": "ABC123", "user": ""}

Here is an example request for a manifest file that does not exist. This request uses the same authorization as the above example but receives a 401 Unauthorized response instead of the expected 404 Not Found.

$ curl -i -H "Authorization: Basic dGVzdDp0ZW1wdGVtcA==" http://localhost:8080/api/manifests/clients/missing.plist
HTTP/1.1 401 Unauthorized
Vary: Cookie
X-Frame-Options: SAMEORIGIN
Content-Type: text/html; charset=utf-8
WWW-Authenticate: Basic realm=""
Set-Cookie:  csrftoken=M1hBnpuZHmiNbBJnaRQy8WHWqU99rj6p; expires=Sat, 25-Mar-2017 16:53:59 GMT; Max-Age=31449600; Path=/
Set-Cookie:  sessionid=1o6fu4cazdquessi4g2l5nwri7neqal6; expires=Sat, 09-Apr-2016 16:53:59 GMT; httponly; Max-Age=1209600; Path=/
Transfer-Encoding: chunked
Date: Sat, 26 Mar 2016 16:53:59 GMT
Server: localhost

munki / mwa2

API GET returns HTTP 401 instead of 404 when requesting non-existent resorces #21