Change invalid_token to 401