removed challange result, fixed bug in ctrl function -> should use unauthorized instead of bad request