[api] fix operation with osc again, send a 401 for modifying operations without given account, not 403