fix(api): request without auth information must be responded to with 401