bad paths should give 401