401 json response returned for non-public routes