Right now we return a raw JSON response to users, but this is a very common flow to hit for onboarding new hires. We should return a redirect to an Unauthorized page with something that has a similar message.