don't 500 when a user is unauthorized to access an API (Case:60771)