Properly handle NOT_AUTHENTICATED status

[christophe-calmejane]

READ_DESCRIPTOR for example can return this status code. Descriptor information should be optional (in case we don't want the controller to enumerate the full model, or in case it's protected by authentication).