We return 402 (payment required) for one of our affected sites. Seems more appropriate.