returning 401 unauthorized instead of 200 #224