respond to unauth with error as well as status