add back-end authorization
fix client-side error when 401 is returned from server