I think the issue is that a custom error page for 401 has been defined in the configuration, but the file does not exist for your vhost, so the 401 reply will be rewritten to index.php.
Try adding a 401 page under the document root, usually, it is /401.shtml for cPanel server.