I found this page regarding the same error I encountered: https://issues.apache.org/bugzilla/show_bug.cgi?id=13430. 

I have 401 error when I view the datastream and object xml pages. It seems instead of being prompted for user name and password from fedora's 401 error page, tomcat handles this error and sends back the generic 401 error page.  This seems an issue a while ago, but I have not found a good answer to handle this error.  Can anyone help me with this matter?  Should I modify the codes in fedora commons? That does not seem the best solution.

Many thanks,