return correct http code if authorization fails