some auth related fixes

AuthInfo to fill in by auth routes (right now manually)

Auth fail should return 401 not 403