The auth dependency raises NotAuthenticatedError (not HTTPException), and the exception handler returns a 302 redirect. Updated the unit test to expect NotAuthenticatedError, and all route auth tests to accept 302 alongside 401/303.