changed not authorized message to be application/json