Paywalls, login pages, and access-denied notices all return HTTP 200. Access is a stack of five layers and status-code checking only tests the bottom two.