They are excellent words but easily confused. See for example HTTP 1.0, which uses "unauthorized"/"authorization" to mean "credentials required"/"credentials", which persists in field names and status codes today.