return appropriate errors on unauthorized client