I'm working through an API design where a user's authentication will be verified by the presence of a valid forms authentication ticket in a session cookie. However, there are additional levels of access that can exist for particular resource URLs. When attempting to access those, it seems like returning a 401 would be the most appropriate response.
However, generally we handle 401s by redirecting to a sign-in page. That would not be a valid course of action for clients on certain resources, where there's an additional step required (e.g., email validation, signing up for a particular role).
Is there a standard way to communicate where to go next when responding with a 401? I'm tempted to include something in the Location header, but that seems only appropriate for 302s after a POST. I'm also reluctant to use URLs to specify where to go, since clients may not be restricted to browsers.
Any good examples or standards docs I can refer to on this?