Return base AP url in unauthorized response from protected resources