if users api token is not valid return unauthorized status