diff --git a/package.json b/package.json
index a5f47536..97b35645 100644
--- a/package.json
+++ b/package.json
@@ -23,7 +23,7 @@
         "node-varnish": "0.1.1",
         "underscore"  : "1.1.x",
         "grainstore"  : "~0.5.0",
-        "windshaft"  : "~0.4.12",
+        "windshaft"  : "~0.4.13",
         "step": "0.0.x",
         "generic-pool": "1.0.x",
         "redis": "0.6.7",
diff --git a/test/acceptance/server.js b/test/acceptance/server.js
index 0f25a9ac..6afcdcd4 100644
--- a/test/acceptance/server.js
+++ b/test/acceptance/server.js
@@ -351,8 +351,8 @@ suite('server', function() {
             url: '/tiles/test_table_private_1/6/31/24.grid.json',
             method: 'GET'
         },{}, function(res) {
-          // NOTE: it would be better to get a '403 - forbidden' here...
-          assert.equal(res.statusCode, 500, res.body);
+          // FIXME: should be 401 Unauthorized
+          assert.equal(res.statusCode, 400, res.statusCode + ': ' + res.body);
           done();
         });
     });
@@ -435,8 +435,11 @@ suite('server', function() {
             url: '/tiles/gadm4/6/31/24.png?' + sql,
             method: 'GET'
         },{
-            status: 500,
-        }, function() { done(); });
+        }, function(res) {
+          // 401 Unauthorized
+          assert.equal(res.statusCode, 401, res.statusCode + ': ' + res.body);
+          done();
+        });
     });
 
     test("get'ing a tile with data from private table should fail when unauthenticated (uses old redis key)", function(done){
@@ -452,8 +455,11 @@ suite('server', function() {
             url: '/tiles/gadm4/6/31/24.png?' + sql,
             method: 'GET'
         },{
-            status: 500,
-        }, function() { done(); });
+        }, function(res) {
+          // 401 Unauthorized
+          assert.equal(res.statusCode, 401, res.statusCode + ': ' + res.body);
+          done();
+        });
     });
 
 });