test bad request
test unauthorized call