ogen's SecurityError message echoes the operation name and internal security text. Map it to a clean 401 so the unauthorized body stays small and leaks nothing.
Kristoffer Dalby