The first response is alwasy ACCESS_DENIED to initiate authentication. Only the second response must not have that status.