Duplicate 401 unauthorised error on incorrect access token

[d-arkfores-t]

I'm getting duplicate 401 responses when an access token in invalid, the body is invalid JSON so is causing issues.

After lots of debugging I've tracked the issue down to the access callback function not returning a boolean value and echoing the error message. Added in this commit: 3d94c6e

Changing the access callback to return false and removing the error output solved the issue for me, my understanding is that nothing should be echo'd from the access callback because it can be called multiple times. This solution does however change the response to a 403 error.

I can't think of a solution that would avoid breaking backwards compatibility, apart from possibly adding a hook invoke to the access callback. Any suggestions on how I can go about making this work for my project?