returning a 401 response status when a request is not auth