Why no 401 if token validation failed?