adding NotAuthorized HTTP response code