added tests for 401 and 403