return 401 for deletion attempts by anonymous users