This is a followup ti http://projects.theforeman.org/issues/3475 which was closed by https://github.com/theforeman/foreman/pull/1253.

We try to be able to use

ErrorDocument 401 /users/login

and we came to the solution of

ErrorDocument 401 /users/login?status=401

because otherwise the resulting status as produced by render is 200 and Kerberos' Negotiate does not kick in. In pull request https://github.com/theforeman/foreman/pull/1253, we try to handle the parameter status=401 and I thought I've tested it back then but it does not seem to work -- the status of that request is 200.