fix error handling in Authorization middleware