fix bug: request with token that doesn't find a user must trigger login