handle API unauthorized requests