return a 401 for a null user or it will hang