Fix format vector

[elucid]

It looks like a9e9093de8e1c0564d4bb1ed97ca693274b51409 broke the catch-all unauthorized response.

This means that a request with e.g. Accept: */* will bypass the guard and return a 200 rather than a 401.