401 instead of redirect option