fix: invalid token results in 404 not 500