better reporting if unauthorized