prevent api without auth from being used
change 501 to 404, updated swagger docs too