more correct handling of else condition for unauthorized