fixed unauthorized url