If your web server gives 200 as a response when the page is not present or the user is not authorized, then you need to use a different web server package. There are standards for these things for a reason. As talexb said already, don't confuse application conditions with protocol conditions.
You are, of course, both correct... If you distinguish between application errors and protocol errors (talexb), then the solution to inappropriate response codes (protocol errors) is indeed to get a new web server (mr_mischief).
Also, I shouldn't have passed on second-hand advice when I don't know the source. Sorry.
Life is denied by lack of attention,
whether it be to cleaning windows
or trying to write a masterpiece...
-- Nadia Boulanger