unauthorized (403) is still valid for unlogged in as you can permit anonymous access to certain resources.

unauthenticated (401) is for when you should be redirecting the user to the login page