modified to return 401 based on accept header