added 401 return for a case where a user token is present instead of a server.