Throw an error when unauthorised.
Previously error was null when a user wasn't unauthorised due to bad credentials (401).
Send user for each request