api/auth: properly check not found error