PAS responds to an unauthorized 401 error by invoking any call plugins, so that the login form does not disable these plugins in acl_users.
A 403 The prohibition shall not lead to a call. However, in production mode (but not in debug mode), these errors are hidden, and they are converted to 404 Not Found.
source
share