error instead of redirect for unauthorized api calls