authentication: Status Code 500 for failed stateless form authentication attempts

First of all, awesome job on this middleware. I’m using stateless API authentication with the Forms authenticator. When posting incorrect email/password:

• the Authenticator throws an UnauthenticatedException (expected)
• the Status Code is 500 (unexpected, I was expecting a 401 or similar)

Am I missing something here or is this intended behavior?