[auth] return a proper error if unauthorized

This fixes #114
[minor] Updating changelog for #140