The 401 response has nothing to do with the initial block download, it literally represents "Unauthorized", and it's returned when you're not passing the username and password using --rpcuser and --rpcpassword command line switches. (See this issue:
https://github.com/bitcoin/bitcoin/issues/9661)
It's also returned when you did not specify a password at launch and you did not use the temporary password inside the .cookie file inside the datadir when you made the call.
How are you making the RPC call? Are you using
curl from another machine with the user and password in your Bitcoin.conf, or are you doing this from a programming language, and which one? We need more information about how you're performing the call.
