location = /authreq.html {
    if ($allowed = 0){
#   return 307 $scheme://$host/404page.html ; #works but should be 404
#   return 404 "shows this message"; #does not redirect when inserting url instead of message
rewrite ^ /404page.html break; #serves 404page.html and doesn't change browseraddress which is good, but sends a response header 200

    }
}