It's common (see: S3, private GitHub repos) to return 404 instead of unauthorized to avoid even leaking existence of a resource at URL.