invalid credentials returns 401 instead of 500