401 errors are now properly returned by bad tokens