401 response to wrong user instead of 403