title: OWIN custom response code for expired token
body: <p>We have a OWIN Web Api 2 site that needs both OAuth2 security and also Windows Integrated Security.</p>
  
  <p>The problem is that when access tokens are expired.  Owin returns a 401 unauthorized response. This causes the browser to popup a login box.
  That's because there are XXX-Authenticate headers with Negotiate and NTLM values. Also one with Bearer</p>
  
  <p>But if we disable Windows Integrated Security in IIS, then it doesn't have those headers but only has XXX-Authenticate: Bearer  and so it the browser does not popup a login window.</p>
  
  <p>On the client side, we want to catch the error code when the token is expired and then refresh the access token.  This actually works except for the browser's ugly popup box asking for id and password.</p>
  
  <p>But we must have both mixed authentication types for this application.</p>
  
  <p>The solution seems to be to send back a different http status code for expired tokens so that the browser won't pop up the login box and we can still catch that code in the client.</p>
  
  <p>However, I'm not having any success figuring how to do this with OWIN.</p>
  
  <p>I registered a middle wear method at the top of the stack to look at
  and modify the response code but when the token is expired it seems
  to return 200 from OWIN but somehow gets changed to 401 when sent
  to the client.</p>
  
  <p>How can I change the status code returned only for expired tokens?</p>