added url mapping back into app -- it seems to have been removed in a previous commit
returning response.status = 401 in error cases to ensure the client displays unauthorized message instead of a server error