return 401 if not logged in