return 401 if principal doesn't exist for auth, not 404