return unauthorized when token is invalid

Change-Id: Id9a5514ff6d19e97e2f86fb5632508f308c8834c