raise API errors when unauthorized