diff --git a/src/allmydata/storage/http_client.py b/src/allmydata/storage/http_client.py
index 2db28dc72..0229bef03 100644
--- a/src/allmydata/storage/http_client.py
+++ b/src/allmydata/storage/http_client.py
@@ -706,6 +706,12 @@ class StorageClientMutables:
         if response.code == http.OK:
             result = await _decode_cbor(response, _SCHEMAS["mutable_read_test_write"])
             return ReadTestWriteResult(success=result["success"], reads=result["data"])
+        elif response.code == http.UNAUTHORIZED:
+            # TODO mabye we can fix this to be nicer at some point? Custom
+            # exception?
+            from foolscap.api import RemoteException
+
+            raise RemoteException("Authorization failed")
         else:
             raise ClientException(response.code, (await response.content()))
 
diff --git a/src/allmydata/storage/http_server.py b/src/allmydata/storage/http_server.py
index 0b407a1c4..748790a72 100644
--- a/src/allmydata/storage/http_server.py
+++ b/src/allmydata/storage/http_server.py
@@ -46,6 +46,7 @@ from .common import si_a2b
 from .immutable import BucketWriter, ConflictingWriteError
 from ..util.hashutil import timing_safe_compare
 from ..util.base32 import rfc3548_alphabet
+from allmydata.interfaces import BadWriteEnablerError
 
 
 class ClientSecretsException(Exception):
@@ -587,19 +588,25 @@ class HTTPServer(object):
             authorization[Secrets.LEASE_RENEW],
             authorization[Secrets.LEASE_CANCEL],
         )
-        success, read_data = self._storage_server.slot_testv_and_readv_and_writev(
-            storage_index,
-            secrets,
-            {
-                k: (
-                    [(d["offset"], d["size"], b"eq", d["specimen"]) for d in v["test"]],
-                    [(d["offset"], d["data"]) for d in v["write"]],
-                    v["new-length"],
-                )
-                for (k, v) in rtw_request["test-write-vectors"].items()
-            },
-            [(d["offset"], d["size"]) for d in rtw_request["read-vector"]],
-        )
+        try:
+            success, read_data = self._storage_server.slot_testv_and_readv_and_writev(
+                storage_index,
+                secrets,
+                {
+                    k: (
+                        [
+                            (d["offset"], d["size"], b"eq", d["specimen"])
+                            for d in v["test"]
+                        ],
+                        [(d["offset"], d["data"]) for d in v["write"]],
+                        v["new-length"],
+                    )
+                    for (k, v) in rtw_request["test-write-vectors"].items()
+                },
+                [(d["offset"], d["size"]) for d in rtw_request["read-vector"]],
+            )
+        except BadWriteEnablerError:
+            raise _HTTPError(http.UNAUTHORIZED)
         return self._send_encoded(request, {"success": success, "data": read_data})
 
     @_authorized_route(
diff --git a/src/allmydata/test/test_istorageserver.py b/src/allmydata/test/test_istorageserver.py
index d9fd13acb..a3e75bbac 100644
--- a/src/allmydata/test/test_istorageserver.py
+++ b/src/allmydata/test/test_istorageserver.py
@@ -1150,7 +1150,6 @@ class HTTPMutableAPIsTests(
 
     # TODO will be implemented in later tickets
     SKIP_TESTS = {
-        "test_STARAW_write_enabler_must_match",
         "test_add_lease_renewal",
         "test_add_new_lease",
         "test_advise_corrupt_share",