Switched to NotAuthorizedException instead of returning responses
directly.