return 401 instead of 400 if no password or username is provided